Actors Insights|Latest update08/07/2026

APT33 Cluster

Suspected state sponsor: Islamic Republic of Iran

APT33 is one of Iran's most active and long-running state-sponsored threat actors, conducting cyber espionage operations since at least 2013. First publicly named by Mandiant in 2017, the group is assessed to operate on behalf of the Iranian government with a focus on intelligence collection rather than destruction. Its primary targets span the aerospace, aviation, energy, defense, satellite, and pharmaceutical sectors, with operations documented across the United States, Saudi Arabia, South Korea, and several other countries.

 

Targets and Goals

APT33's core mission is intelligence collection in support of Iranian state interests. The group has consistently targeted organizations involved in military and commercial aviation, oil and petrochemical production, and defense contracting. Researchers assess the group's interest in Saudi Arabian aviation mirrors Iran's broader strategic rivalry with Saudi Arabia, while targeting of energy companies reflects Iran's competitive interest in the global petrochemical market.

 

Tooling and Tactics

The group uses two main access vectors: spear phishing emails with job-recruitment themes carrying malicious .hta files, and large-scale password spray campaigns targeting thousands of organizations simultaneously. After gaining access, APT33 deploys a range of custom tools including the TURNEDUP backdoor, the POWERTON implant, and in select cases the DROPSHOT wiper. More recent campaigns attributed to the cluster under the Peach Sandstorm name show increased sophistication in cloud-based post-compromise activity, including the use of AzureHound and Roadtools for Azure Active Directory reconnaissance and a new backdoor named TICKLER.

 

Aliases

APT33 is tracked under multiple names across the industry: Elfin (Symantec), Refined Kitten (CrowdStrike), HOLMIUM and Peach Sandstorm (Microsoft), Magnallium (Dragos), and Gray Sandstorm for more recent activity. DEV-0343 was a temporary Microsoft staging designation used before formal attribution to this cluster.

Most Common Tactics

Targeted Regions

Australia
AU
Australia
Australia
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Belgium
BE
Belgium
Belgium
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
China
CN
China
China
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Czech Republic
CZ
Czech Republic
Czech Republic
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Europe
EU
Europe
Europe
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
Aug 2018 ~ Dec 2018
May 2016 ~ Dec 2019
Aug 2018 ~ Dec 2018
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
Mar 2026 ~ Mar 2026
Israel
IL
Israel
Israel
Mar 2026 ~ Mar 2026
Italy
IT
Italy
Italy
Dec 2019 ~ May 2020
Dec 2019 ~ May 2020
Jordan
JO
Jordan
Jordan
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Middle East
ME
Middle East
Middle East
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
May 2016 ~ Dec 2019
Aug 2018 ~ Dec 2018
May 2016 ~ Dec 2019
May 2019 ~ Sep 2019
Aug 2018 ~ Dec 2018
Jun 2019 ~ Jul 2019
May 2016 ~ Dec 2019
May 2019 ~ Sep 2019
Jun 2019 ~ Jul 2019
May 2016 ~ Dec 2019
Morocco
MA
Morocco
Morocco
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jun 2018 ~ Jun 2018
May 2018 ~ May 2018
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Mar 2026 ~ Mar 2026
South Korea
KR
South Korea
South Korea
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jun 2016 ~ Sep 2017
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Thailand
TH
Thailand
Thailand
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Mar 2026 ~ Mar 2026
United Kingdom
GB
United Kingdom
United Kingdom
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Mar 2026 ~ Mar 2026
United States
US
United States
United States
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jun 2016 ~ Sep 2017
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jun 2016 ~ Sep 2017
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2016 ~ Dec 2019
Jun 2016 ~ Sep 2017
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Nov 2017 ~ Dec 2018
Nov 2017 ~ Dec 2018
May 2016 ~ Dec 2019
Jun 2016 ~ Sep 2017
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
Nov 2017 ~ Dec 2018
Nov 2017 ~ Dec 2018
May 2016 ~ Dec 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2019 ~ Sep 2019
Nov 2017 ~ Dec 2018
Nov 2017 ~ Dec 2018
Jun 2019 ~ Jul 2019
May 2016 ~ Dec 2019
Dec 2015 ~ Mar 2019
Jan 2013 ~ Dec 2019
Jan 2013 ~ Oct 2019
May 2019 ~ Sep 2019
Jun 2019 ~ Jul 2019
May 2016 ~ Dec 2019
Apr 2020 ~ Jul 2020
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Dec 2023 ~ Jan 2024
Nov 2021 ~ Aug 2024
Mar 2026 ~ Mar 2026
Jan 2013Jun 2026

Recent Activities

  1. Public
    Iran-Linked Threat Actor Targets Middle East Cloud Environments with Password Spraying
  2. Public
    Peach Sandstorm Targets US and UAE Critical Sectors with Tickler Malware
  3. Public
    Peach Sandstorm's FalseFont Backdoor Targets Defense Industrial Base
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.