The Elfin Threat: Customized Malware Attacks Across Diverse Sectors

Elfin, an Iranian-linked espionage group also known as APT33, conducted a sustained campaign targeting at least 50 organizations across Saudi Arabia, the United States, and other countries between late 2015 and early 2019. The group used spearphishing emails, custom malware, and commodity hacking tools to break into target networks, steal credentials, and exfiltrate data. A notable February 2019 incident involved an attempted exploitation of a vulnerability in the WinRAR file archiver against a Saudi chemical company.

The campaign is attributed to Elfin, a threat group that security researchers also track as APT33 and link to Iran. The group has been active since at least late 2015 and specializes in cyber espionage operations against organizations in the Middle East, the United States, and other regions. Symantec, which published this analysis in March 2019, describes the group as "one of the most active groups currently operating in the Middle East."

The primary goal was intelligence collection and data theft. Elfin broke into target networks to harvest credentials, access sensitive files, and exfiltrate data to attacker-controlled servers. The group used a range of backdoors and remote access tools to maintain long-term access, and in one documented case remained active inside a compromised U.S. organization for nearly two months. Researchers also noted a possible connection to Shamoon wiper attacks, though no conclusive link was established.

The campaign was broad in both geography and scale. At least 50 organizations were compromised or targeted across multiple countries including Saudi Arabia, the United States, Belgium, the United Kingdom, the United Arab Emirates, Jordan, Morocco, Czech Republic, China, and Thailand. Saudi Arabia accounted for roughly 42 percent of observed attacks, while 18 U.S. organizations were targeted over a three-year period — including several Fortune 500 companies.

Elfin cast a wide net across industries. Targeted sectors included research, chemical, engineering, manufacturing, consulting, finance, telecommunications, energy, information technology, and healthcare. Some U.S. targets appeared to be selected as entry points for potential supply chain attacks — in at least one case, a large U.S. company was attacked the same month its Middle Eastern co-owned subsidiary was also compromised.

Elfin typically started with a spearphishing email, often disguised as a job vacancy notice, containing a malicious link. Clicking the link downloaded a malicious HTML file that executed PowerShell commands in the background, establishing a backdoor connection to the attackers' servers. From there, the group installed additional tools for credential theft, set up scheduled tasks to maintain persistence, and ultimately exfiltrated data over FTP using a custom-built tool called FastUploader. The full intrusion in one documented case unfolded over roughly seven weeks.

Saudi Arabia and the United States hold strategic interest for Iran-linked actors because of their roles in regional geopolitics, energy markets, and defense industries. Organizations in chemical, engineering, and energy sectors likely hold proprietary technical data of value to state-sponsored intelligence collection. U.S. Fortune 500 companies in these sectors also provide potential access to global supply chains — giving attackers the ability to reach additional targets through trusted relationships.