APT33 Targets Engineering Sector: A Blend of Public Tools and Custom Malware

Between November 2017 and December 2018, FireEye's Managed Defense team detected and contained multiple targeted intrusions against US engineering companies, attributed to APT33 — an Iranian state-sponsored hacking group. The attackers abused Microsoft Exchange and Outlook to gain initial access using stolen credentials, then deployed a progression of tools from publicly available frameworks to a custom-built backdoor called POWERTON, designed to give them persistent, covert access to victim networks.

The attacks were carried out by APT33, also known as Elfin or Refined Kitten — an Iranian state-sponsored group confirmed in July 2019 by FireEye to be operating at the behest of the Iranian government. APT33 has been active since at least 2013 and is known for targeting energy, aerospace, and engineering organizations, particularly in the United States and the Middle East. FireEye initially assessed attribution at low-to-medium confidence based on tool and timeline overlap with confirmed APT33 activity; full attribution was confirmed after the group's June 2019 campaign against US federal agencies.

The primary goal was to gain and maintain persistent access to engineering sector networks for espionage and data collection. The attackers showed remarkable persistence — each time Managed Defense contained an intrusion, the actor reestablished access within weeks using a different method or new infrastructure. Mandiant also noted that APT33 has documented ties to destructive malware, including SHAMOON (a disk-wiping tool), suggesting the group is capable of transitioning from espionage to destructive attacks against critical infrastructure if directed to do so.

The documented intrusions were contained to a small number of US engineering firms, but the scope of APT33's broader activity is significantly wider. The group's June 2019 campaign targeted US federal government agencies, financial institutions, retail companies, media organizations, and educational institutions. APT33 also consistently targets the energy sector, which Mandiant assessed as facing a heightened risk from the group — consistent with Iran's strategic interest in understanding and potentially disrupting petrochemical and energy infrastructure.

The primary targets in this campaign were organizations in the engineering industry in the United States. APT33 more broadly targets the energy and aerospace sectors — specifically petrochemical companies, defense contractors, and government entities in the US, Saudi Arabia, South Korea, and across the Middle East. Mandiant specifically flagged the energy sector as the highest-risk industry due to APT33's consistent focus and its documented links to SHAMOON, which has been used to destroy data and disrupt operations at energy companies.

The attackers first obtained or guessed valid email credentials, then used a public tool called RULER to exploit Microsoft Exchange features — either creating malicious email rules that automatically downloaded and ran malware, or modifying a victim's Outlook homepage to silently execute code every time Outlook opened. This gave the attackers a persistent foothold that survived reboots. From there they installed a series of backdoors, starting with publicly available tools like PUPYRAT and PoshC2, and eventually deploying POWERTON — their own custom PowerShell backdoor — which communicated with attacker servers using AES encryption to avoid detection. When defenders blocked them, they regained access through password spraying, testing common passwords against many accounts until one worked.

Engineering companies hold sensitive technical data — design schematics, operational processes, and proprietary systems — that has both intelligence value and potential use in preparing for destructive attacks against industrial infrastructure. The energy sector is particularly attractive because it aligns with Iran's strategic objectives around understanding and potentially influencing petrochemical production capacity in rival states. US federal agencies are high-priority targets for state-level intelligence collection. The breadth of APT33's targeting across government, finance, media, and education also suggests a broad intelligence collection mandate beyond any single sector.