Actors Insights|Latest update08/07/2026

HOLMIUM

Named by MicrosoftSuspected state sponsor: Islamic Republic of Iran

HOLMIUM is Microsoft's legacy tracking designation for the Iranian threat actor now formally named Peach Sandstorm, which is widely known across the industry as APT33. The group has been active since at least 2013 and conducts espionage operations primarily targeting the aerospace, defense, satellite, energy, and pharmaceutical sectors. Microsoft retired the HOLMIUM name as part of an updated threat actor naming taxonomy. Under both names, the same cluster is responsible for large-scale password spray campaigns, spear phishing with malicious .hta files, and post-compromise use of tools such as AzureHound and the TICKLER backdoor.

This threat actor's name is changed to Peach Sandstorm
First Seen:Jan 2013
Last Seen:Mar 2026
Indexed Reports:4
Public IOCs:37
Cluster: APT33Mitre: APT33Misp: APT33
also known as:
APT 33Elfin (Symantec)Magnallium (Dragos)Refined Kitten (CrowdStrike)HOLMIUM (Microsoft)COBALT TRINITY (SecureWorks)G0064 (Mitre)ATK35 (Thales)Peach Sandstorm (Microsoft)TA451 (Proofpoint)

Targeted Regions

Australia
AU
Australia
Australia
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
United States
US
United States
United States
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Dec 2023 ~ Jan 2024
Nov 2021 ~ Aug 2024
Dec 2023 ~ Jan 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Jan 2021Oct 2026

Targeted Sectors

DefenseAerospaceGovernment Agencies and ServicesEducationOil and GasTelecommunicationPharmaceuticals

Recent Indexed Reports

  1. Public
    Peach Sandstorm Targets US and UAE Critical Sectors with Tickler Malware
  2. Public
    Peach Sandstorm's FalseFont Backdoor Targets Defense Industrial Base
  3. Public
    Peach Sandstorm’s Multi-Faceted Attacks on Satellite, Defense, and Pharma Sectors

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.