CVE Intelligence
Home / Threat actors / APT33

APT33 G0064

🔔 Create alert

Also known as: HOLMIUM, Elfin, Peach Sandstorm

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

3
associated CVEs
42
Techniques
16
Malware and tools

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2018-20250 High · 7.8 KEV Ransomware WinRAR Absolute Path Traversal Vulnerability
“APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).”
CVE-2017-11774 High · 7.8 KEV Microsoft Office Outlook Security Feature Bypass Vulnerability
“APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).”
CVE-2017-0213 High · 7.3 KEV Ransomware Microsoft Windows Privilege Escalation Vulnerability
“APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.”

Techniques by tactic

Resource Development
T1588.002 Tool
Initial Access
T1078 Valid AccountsT1078.004 Cloud AccountsT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious File
Persistence
T1053.005 Scheduled TaskT1078 Valid AccountsT1078.004 Cloud AccountsT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.004 Cloud AccountsT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup Folder
Stealth
T1027.013 Encrypted/Encoded FileT1078 Valid AccountsT1078.004 Cloud Accounts
Credential Access
T1003.001 LSASS MemoryT1003.004 LSA SecretsT1003.005 Cached Domain CredentialsT1040 Network SniffingT1110.003 Password SprayingT1552.001 Credentials In FilesT1552.006 Group Policy PreferencesT1555 Credentials from Password StoresT1555.003 Credentials from Web Browsers
Discovery
T1040 Network Sniffing
Collection
T1560.001 Archive via Utility
Command and Control
T1071.001 Web ProtocolsT1105 Ingress Tool TransferT1132.001 Standard EncodingT1571 Non-Standard PortT1573.001 Symmetric Cryptography
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.