Cyber Espionage on Aviation: APT33 Targets US, Saudi Arabia, and South Korea

APT33, an Iranian state-sponsored hacking group, conducted a sustained cyber espionage campaign targeting organizations in the United States, Saudi Arabia, and South Korea. The group focused on the aerospace and energy sectors, breaking into networks via job-lure spearphishing emails to steal intelligence on military aviation capabilities and petrochemical operations. Mandiant researchers documented the campaign in September 2017, identifying compromises dating back to at least 2016.

APT33, an Iranian state-sponsored hacking group, conducted a sustained cyber espionage campaign targeting organizations in the United States, Saudi Arabia, and South Korea. The group focused on the aerospace and energy sectors, breaking into networks via job-lure spearphishing emails to steal intelligence on military aviation capabilities and petrochemical operations. Mandiant researchers documented the campaign in September 2017, identifying compromises dating back to at least 2016.

The attacks are attributed to APT33, a threat group Mandiant assesses to work on behalf of the Iranian government. Evidence supporting this includes the group's use of tools and DNS servers associated with Iranian hacker communities, attacker activity hours consistent with Iran's UTC+4:30 time zone, and a Saturday-to-Wednesday workweek matching Iran's government schedule. A developer handle found in TURNEDUP malware samples was also linked to Iran's "Nasr Institute," reportedly tied to Iran's cyber operations infrastructure.

The primary goal was intelligence collection — gaining insight into Saudi Arabia's military aviation capabilities, Iran's regional rivals, and the petrochemical industry. APT33 also had potential destructive capability: the DROPSHOT dropper it used has been linked to SHAPESHIFT, a disk-wiping malware that can destroy data on infected systems. While destructive use was not directly observed in this campaign, the connection raises concern about the group's broader intent.

The campaign targeted organizations across three countries — the United States, Saudi Arabia, and South Korea. Known victims include a U.S. aerospace company, a Saudi business conglomerate with aviation holdings, and a South Korean oil refining and petrochemicals company. APT33 registered spoofed domains impersonating four major defense and aviation firms — Boeing, Alsalam Aircraft Company, Northrop Grumman Aviation Arabia, and Vinnell Arabia — and sent hundreds of spearphishing emails to aviation-sector employees.

APT33 focused specifically on the aerospace and energy sectors. Within aerospace, the group targeted both military and commercial aviation organizations, including firms involved in aircraft maintenance, training, and Saudi Arabia's rotorcraft fleet. In energy, it focused on petrochemical companies — particularly those with ties to Saudi Arabia — likely to benefit Iran's own ambitions to expand petrochemical production and compete regionally. Employees in aviation-related roles were the primary recipients of spearphishing emails.

APT33 sent targeted emails to aviation employees that appeared to be legitimate job postings — complete with specific salary details, links to spoofed company websites, and equal opportunity hiring statements. Each email contained a link to a malicious .hta (HTML Application) file. When opened, the file displayed plausible job content while silently downloading the TURNEDUP backdoor in the background. The DROPSHOT dropper staged and launched the backdoor, giving attackers persistent remote access to compromised machines.

Saudi Arabia is Iran's primary regional rival, and its military aviation capabilities and petrochemical industry are of direct strategic interest to Iran. The U.S. organizations targeted had defense and aviation partnerships with Saudi Arabia, making them valuable intelligence targets. South Korean companies were likely targeted due to their partnerships with both Iran's and Saudi Arabia's petrochemical sectors. Mandiant assesses APT33 may be trying to enhance Iran's aviation capabilities and support military decision-making against regional adversaries.