CVE Intelligence
Início / Grupos de ameaça / APT33

APT33 G0064

🔔 Criar alerta

Também conhecido como: HOLMIUM, Elfin, Peach Sandstorm

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

3
CVEs associadas
42
Técnicas
16
Malwares e ferramentas

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2018-20250 Alta · 7.8 KEV Ransomware WinRAR Absolute Path Traversal Vulnerability
“APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).”
CVE-2017-11774 Alta · 7.8 KEV Microsoft Office Outlook Security Feature Bypass Vulnerability
“APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).”
CVE-2017-0213 Alta · 7.3 KEV Ransomware Microsoft Windows Privilege Escalation Vulnerability
“APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.”

Técnicas por tática

Desenvolvimento de recursos
T1588.002 Tool
Acesso inicial
T1078 Valid AccountsT1078.004 Cloud AccountsT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execução
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.005 Visual BasicT1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious File
Persistência
T1053.005 Scheduled TaskT1078 Valid AccountsT1078.004 Cloud AccountsT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup Folder
Escalada de privilégios
T1053.005 Scheduled TaskT1068 Exploitation for Privilege EscalationT1078 Valid AccountsT1078.004 Cloud AccountsT1546.003 Windows Management Instrumentation Event SubscriptionT1547.001 Registry Run Keys / Startup Folder
Furtividade
T1027.013 Encrypted/Encoded FileT1078 Valid AccountsT1078.004 Cloud Accounts
Acesso a credenciais
T1003.001 LSASS MemoryT1003.004 LSA SecretsT1003.005 Cached Domain CredentialsT1040 Network SniffingT1110.003 Password SprayingT1552.001 Credentials In FilesT1552.006 Group Policy PreferencesT1555 Credentials from Password StoresT1555.003 Credentials from Web Browsers
Descoberta
T1040 Network Sniffing
Coleta
T1560.001 Archive via Utility
Comando e controle
T1071.001 Web ProtocolsT1105 Ingress Tool TransferT1132.001 Standard EncodingT1571 Non-Standard PortT1573.001 Symmetric Cryptography
Exfiltração
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Malwares e ferramentas

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.