LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0064: APT33

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]

EnterpriseG0064GroupObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

G0064: APT33 describes [APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)

Executive priority

G0064: APT33 is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate G0064: APT33 by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

  • Official ATT&CK relationships and object metadata

Detection direction

  • Validate whether G0064: APT33 appears in your detection coverage and tabletop scenarios.
  • Use the object to align executive risk language with SOC, incident response, and detection engineering work.
  • Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

  • Map the object to existing controls and identify missing telemetry or response ownership.
  • Prioritize mitigations that reduce exposure on the listed platforms and tactics.
  • Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

APT33

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

31 rows
DomainIDNameRelationship / procedure
EnterpriseT1552.001Credentials In FilesSub-technique

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[3]CitationFireEye APT33 Guardrail

EnterpriseT1003.005Cached Domain CredentialsSub-technique

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[3]CitationFireEye APT33 Guardrail

EnterpriseT1560.001Archive via UtilitySub-technique

APT33 has used WinRAR to compress data prior to exfil.[3]

EnterpriseT1555.003Credentials from Web BrowsersSub-technique

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[3]CitationFireEye APT33 Guardrail

EnterpriseT1552.006Group Policy PreferencesSub-technique

APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.[3]CitationFireEye APT33 Guardrail

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

APT33 has used base64 to encode payloads.CitationFireEye APT33 Guardrail

EnterpriseT1566.001Spearphishing AttachmentSub-technique

APT33 has sent spearphishing e-mails with archive attachments.[4]

EnterpriseT1003.001LSASS MemorySub-technique

APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.[3]CitationFireEye APT33 Guardrail

EnterpriseT1566.002Spearphishing LinkSub-technique

APT33 has sent spearphishing emails containing links to .hta files.[1][3]

EnterpriseT1110.003Password SprayingSub-technique

APT33 has used password spraying to gain access to target systems.CitationFireEye APT33 Guardrail[4]

EnterpriseT1003.004LSA SecretsSub-technique

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[3]CitationFireEye APT33 Guardrail

EnterpriseT1053.005Scheduled TaskSub-technique

APT33 has created a scheduled task to execute a .vbe file multiple times a day.[3]

EnterpriseT1555Credentials from Password Stores

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[3]CitationFireEye APT33 Guardrail

EnterpriseT1546.003Windows Management Instrumentation Event SubscriptionSub-technique

APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.[4]

EnterpriseT1105Ingress Tool Transfer

APT33 has downloaded additional files and programs from its C2 server.[3][4]

EnterpriseT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique

APT33 has used FTP to exfiltrate files (separately from the C2 channel).[3]

EnterpriseT1588.002ToolSub-technique

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.CitationFireEye APT33 Guardrail[3]

EnterpriseT1040Network Sniffing

APT33 has used SniffPass to collect credentials by sniffing network traffic.[3]

EnterpriseT1071.001Web ProtocolsSub-technique

APT33 has used HTTP for command and control.[3]

EnterpriseT1059.001PowerShellSub-technique

APT33 has utilized PowerShell to download files from the C2 server and run various scripts. [3][4]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.[3][4]

EnterpriseT1078Valid Accounts

APT33 has used valid accounts for initial access and privilege escalation.[2]CitationFireEye APT33 Guardrail

EnterpriseT1573.001Symmetric CryptographySub-technique

APT33 has used AES for encryption of command and control traffic.CitationFireEye APT33 Guardrail

EnterpriseT1059.005Visual BasicSub-technique

APT33 has used VBScript to initiate the delivery of payloads.[4]

EnterpriseT1132.001Standard EncodingSub-technique

APT33 has used base64 to encode command and control traffic.CitationFireEye APT33 Guardrail

EnterpriseT1571Non-Standard Port

APT33 has used HTTP over TCP ports 808 and 880 for command and control.[3]

EnterpriseT1078.004Cloud AccountsSub-technique

APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.[4]

EnterpriseT1203Exploitation for Client Execution

APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).[3][4]

EnterpriseT1204.002Malicious FileSub-technique

APT33 has used malicious e-mail attachments to lure victims into executing malware.[4]

EnterpriseT1204.001Malicious LinkSub-technique

APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.[1][3]

EnterpriseT1068Exploitation for Privilege Escalation

APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.CitationFireEye APT33 Guardrail

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0194: PowerSploit

PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]

Windows
MalwareEnterprise

S0129: AutoIt backdoor

AutoIt backdoor is malware that has been used by the actors responsible for the MONSOON campaign. The actors frequently used it in weaponized .pps files exploiting CVE-2014-6352. [1] This malware makes use of the legitimate scripting language for Windows GUI automation with the same name.

Windows
ToolEnterprise

S0378: PoshC2

PoshC2 is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in PowerShell. Although PoshC2 is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.[1]

WindowsLinuxmacOS
ToolEnterprise

S0358: Ruler

Ruler is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of Ruler have also released a defensive tool, NotRuler, to detect its usage.[1][2]

WindowsOffice Suite
ToolEnterprise

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows
MalwareEnterprise

S0336: NanoCore

NanoCore is a modular remote access tool developed in .NET that can be used to spy on victims and steal information. It has been used by threat actors since 2013.[1][2][3][4]

Windows
MalwareEnterprise

S1134: DEADWOOD

DEADWOOD is wiper malware written in C++ using Boost libraries. DEADWOOD was first observed in an unattributed wiping event in Saudi Arabia in 2019, and has since been incorporated into Agrius operations.[1]

Windows
MalwareEnterprise

S0371: POWERTON

POWERTON is a custom PowerShell backdoor first observed in 2018. It has typically been deployed as a late-stage backdoor by APT33. At least two variants of the backdoor have been identified, with the later version containing improved functionality.[1]

Windows
ToolEnterprise

S0349: LaZagne

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.[1]

LinuxmacOSWindows
MalwareEnterprise

S0198: NETWIRE

NETWIRE is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.[1][2][3]

WindowsLinuxmacOS
Relationship explorer

All related ATT&CK context

uses · ToolS0194: PowerSploitEnterpriseuses · TechniqueT1552.001: Credentials In FilesEnterpriseuses · TechniqueT1003.005: Cached Domain CredentialsEnterpriseuses · TechniqueT1560.001: Archive via UtilityEnterpriseuses · MalwareS0129: AutoIt backdoorEnterpriseuses · ToolS0378: PoshC2Enterpriseuses · ToolS0358: RulerEnterpriseuses · ToolS0002: MimikatzEnterpriseuses · TechniqueT1555.003: Credentials from Web BrowsersEnterpriseuses · TechniqueT1552.006: Group Policy PreferencesEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · MalwareS0336: NanoCoreEnterpriseuses · MalwareS1134: DEADWOODEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · MalwareS0380: StoneDrillEnterpriseuses · MalwareS0371: POWERTONEnterpriseuses · TechniqueT1110.003: Password SprayingEnterpriseuses · TechniqueT1003.004: LSA SecretsEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1555: Credentials from Password StoresEnterpriseuses · ToolS0349: LaZagneEnterpriseuses · TechniqueT1546.003: Windows Management Instrumentation Event SubscriptionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
2.0
Created
Modified
Raw hash
45594e3d60a4c9c3...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.02.0Current bundle45594e3d60a4…
19.22.0Older bundle45594e3d60a4…
19.12.0Older bundle8bce83bff7b0…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye APT33 Sept 2017

    O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.

    Open source URL
  2. [2]
    FireEye APT33 Webinar Sept 2017

    Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.

    Open source URL
  3. [3]
    Symantec Elfin Mar 2019

    Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.

    Open source URL
  4. [4]
    Microsoft Holmium June 2020

    Microsoft Threat Protection Intelligence Team. (2020, June 18). Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint. Retrieved June 22, 2020.

    Open source URL
  5. [5]
    APT33

    (Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)

  6. [6]
    Elfin

    (Citation: Symantec Elfin Mar 2019)

  7. [7]
    HOLMIUM

    (Citation: Microsoft Holmium June 2020)

  8. [8]
    Microsoft Threat Actor Naming July 2023

    Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.

    Open source URL
  9. [9]
    Peach Sandstorm

    (Citation: Microsoft Threat Actor Naming July 2023)

  10. [10]
    mitre-attackG0064
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use