APT33
IntrusionSet · ATTACK:enterprise:G0064
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0064",
"title": "APT33",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0064",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--fbd29c89-18ba-4c2d-b792-51c0adee049f",
"external_id": "G0064",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2026-07-31T20:48:52.730Z",
"version": "2.0",
"aliases": [
"APT33",
"HOLMIUM",
"Elfin",
"Peach Sandstorm"
],
"tactics": [
],
"source_references": [
{
"source_name": "APT33"
},
{
"source_name": "HOLMIUM"
},
{
"source_name": "Peach Sandstorm"
},
{
"source_name": "Elfin"
},
{
"source_name": "FireEye APT33 Webinar Sept 2017",
"url": "https://www.brighttalk.com/webcast/10703/275683"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Holmium June 2020",
"url": "https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"
},
{
"source_name": "FireEye APT33 Sept 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"
},
{
"source_name": "Symantec Elfin Mar 2019",
"url": "https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"
}
]
}Explicit source assertions (47)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0194
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--148d82d9-c55b-4ce4-adb2-79387dab01ab
FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1552.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16952ba0-4fae-450b-990c-2b771efbd60f
Symantec Elfin Mar 2019 · FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1003.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--176244be-553b-48ac-8e38-9b006d6c360e
Symantec Elfin Mar 2019 · FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f48a517-c041-4845-9aba-2dce4f559b56
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0129
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--253ab30c-ec7c-42bc-a27d-984722c59a98
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0378
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--27f3f0b2-4743-420d-a4dd-842de6cb9e70
FireEye APT33 Guardrail · Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0358
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--33f1d509-3bca-492a-a08b-9e0561433b5f
FireEye APT33 Guardrail · Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b056bef-e49e-4611-8c20-23cc14689b74
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1555.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3baf9dda-1286-4a3b-874b-7a04f0172aae
Symantec Elfin Mar 2019 · FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1552.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ca3a169-177b-44aa-b9c1-40e605f8edad
Symantec Elfin Mar 2019 · FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1027.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f29b80a-0444-4664-8faa-58a39de9264e
FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54fd87c2-7d29-422f-bf92-96e7d603563f
Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0336
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57a7fefa-774b-4653-af2d-ebf3e2e315ce
FireEye APT33 Webinar Sept 2017ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S1134
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--58baeaa3-4a41-4907-b695-53723529483b
RecordedFuture IranianResponse 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fd13ed0-28df-4131-a653-0fa5a760ff95
Symantec Elfin Mar 2019 · FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--639e7b8d-57d7-4c1d-8f42-1496606ea666
FireEye APT33 Sept 2017 · Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0380
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65321ae3-b76c-4288-9456-207641b14aa7
FireEye APT33 Sept 2017ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0371
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ea02c5b-f60b-4774-a237-fcc3f498a4f5
FireEye APT33 Guardrail · Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1110.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b5691c7-1815-4d76-a7dd-dfd827043bb9
FireEye APT33 Guardrail · Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1003.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--990e1dac-f103-47c0-91d8-a5238ffc6b99
Symantec Elfin Mar 2019 · FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9a380085-30dd-4a57-bd52-f85acd584e43
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1555
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c555aa7-87fa-4c5d-9224-a61cd0d0157f
Symantec Elfin Mar 2019 · FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0349
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d4aa0d4-b460-4320-8c46-2d6ffbe675af
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9e1bb696-e1f0-46d3-ab91-79280323d711
Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a06ada98-605a-47c5-9362-41e86c2ada6e
Symantec Elfin Mar 2019 · Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0199
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a36bddd3-6993-4f3f-9298-cba2868438b2
FireEye APT33 Sept 2017 · FireEye APT33 Webinar Sept 2017 · Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a501c3c3-66f7-4128-bf47-b6bf816d5411
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aa82f131-3eeb-4d1a-9f2e-bb2efcc7470b
FireEye APT33 Guardrail · Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b1ca60ac-cef2-467e-843c-5732d8885626
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf7102db-9b22-4534-ac52-83d95152c242
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0198
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c775ee2d-b7eb-443a-94e9-bb450e2bcd35
FireEye APT33 Sept 2017 · FireEye APT33 Webinar Sept 2017ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd69ba48-b716-4278-b1a0-2efd3bd2d4de
Symantec Elfin Mar 2019 · Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d15c3d84-9e21-41ac-9728-f97183b63ec6
Symantec Elfin Mar 2019 · Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d22af09f-5536-4416-827c-e401cfae3002
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0192
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2c3b075-5299-42e5-95de-8248dc0da551
FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0363
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3b5af98-ac27-4135-9da6-8e917cc0769d
FireEye APT33 Guardrail · Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3d44322-8902-4f56-8625-fb14557c0ca8
FireEye APT33 Webinar Sept 2017 · FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1573.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e053cb07-3e4d-41a1-85a6-38cd2ac0e6ea
FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1059.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e0d647cf-69a0-416f-8db4-cfd72fbd6ad3
Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1132.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e1492807-b520-412b-9df7-105aefc29deb
FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1571
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e6b9c4c1-3b84-4957-8533-f96a92dcab2a
Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e93a3bf7-2ca4-42ed-872a-f9f0f8458936
Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e948752d-c4a1-4678-97e4-2bd11563115e
Symantec Elfin Mar 2019 · Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed0428f5-d354-4827-8f9a-95177ce0a1cb
Microsoft Holmium June 2020ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6cd8be3-3145-4088-ae9d-d006be865c01
FireEye APT33 Sept 2017 · Symantec Elfin Mar 2019ATTACK:enterprise:G0064 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f72d9afb-4eb1-4030-9d91-938f80c4bf6e
FireEye APT33 GuardrailATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0095
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fca4685f-76c5-4089-b318-8f2ebab802d0
Symantec Elfin Mar 2019