Executive Summary
APT33 is a suspected Iranian state cyber-espionage group, active since at least 2013, that Mandiant/FireEye assesses operates at the Iranian government’s direction, with reported ties to the Nasr Institute. MITRE’s current ATT&CK entry (G0064) lists its primary aliases as APT33, HOLMIUM, Elfin, and Peach Sandstorm — the last being Microsoft’s current designation and the name attached to the group’s most recent documented activity. That activity, a custom backdoor called Tickler deployed between April and July 2024 against government, defense, satellite, pharmaceutical, and oil-and-gas targets in the US and UAE, is also the most recent well-sourced reporting on this group available. A November 2025 Brandefense forecast describes a general shift toward cloud and identity-centric attacks across the threat landscape, but no dedicated APT33-specific campaign, advisory, or incident dated after that forecast turned up in research for this piece. Separately — and this needs to be said plainly because the confusion is easy to make — an April 2026 CISA advisory on Iranian exploitation of industrial control systems is attributed to a different group, CyberAv3ngers, not APT33.
Origins and the Wiper Question
FireEye’s 2017 reporting on the group’s toolset described three custom tools: DROPSHOT, a dropper that Kaspersky separately tracks as StoneDrill; SHAPESHIFT, a wiper; and TURNEDUP, a custom backdoor. The 2017 campaign used fake aviation job postings — targeting companies including Boeing, Alsalam Aircraft, and Northrop Grumman Aviation Arabia — delivered via malicious .hta files, consistent with the aviation and energy sector focus MITRE and CFR both attribute to the group.
The wiper question deserves its own paragraph because it’s genuinely disputed, not just under-confirmed. Kaspersky’s analysis of StoneDrill found stylistic similarities to the Shamoon wiper — the malware behind some of the most destructive attacks against Saudi energy-sector targets — but explicitly stopped short of concluding the two shared an operator. Overlapping code style is weaker evidence than shared infrastructure or operational overlap, and Kaspersky treated it that way. Confidence in APT33’s involvement in destructive wiper attacks is meaningfully lower than confidence in its core espionage activity, and any mention of the Shamoon connection should carry that caveat rather than assert it as settled.
One claim worth explicitly ruling out: a sometimes-repeated detail about APT33 using a VSTO-based (Visual Studio Tools for Office) dropper did not turn up in any source checked for this piece. It should be treated as unconfirmed and not repeated as established fact.
Targeting
MITRE’s entry lists the United States, Saudi Arabia, and South Korea as primary targets, with particular interest in aviation and energy. The Council on Foreign Relations’ tracking adds private-sector aviation, energy, and petrochemical companies to that picture. A secondary, lower-confidence profile — not independently verified against the primary Symantec reporting it appears to draw from — puts roughly 42% of attacks by the Elfin cluster since 2016 against Saudi targets; treat that figure as indicative rather than confirmed. By 2023–2024, Microsoft’s reporting under the Peach Sandstorm name shows expanded targeting into satellite, defense industrial base, pharmaceutical, government, and oil-and-gas sectors specifically in the US and UAE — a geographic and sector expansion from the group’s earlier, more Gulf-and-aviation-centric footprint.
Tickler: The Most Recent Confirmed Activity
Microsoft’s reporting on the Tickler backdoor is the clearest recent data point on this group. Tickler is a custom, multi-stage backdoor that Peach Sandstorm deployed between April and July 2024, notable for its command-and-control approach: the group set up fraudulent, attacker-controlled Azure subscriptions to host C2 infrastructure, abusing the cloud platform’s own trust relationships. Microsoft identified and disrupted the fraudulent subscriptions as part of its response. Targeting in this campaign concentrated on government, defense, satellite, and oil-and-gas organizations in the United States and United Arab Emirates — consistent with the sector and geographic expansion Microsoft had already been tracking.
Where the Trail Goes Cold
After the Tickler reporting, the public record thins out considerably. A Brandefense “2025 Threat Forecast,” published in November 2025, describes a broader industry shift toward cloud-centric and identity-centric attack techniques, which is consistent with Peach Sandstorm’s Azure-abuse approach in Tickler, but doesn’t describe a new named APT33/Peach Sandstorm campaign. No dedicated advisory, incident report, or vendor writeup specific to this group dated between that forecast and October 2026 was identified for this piece. That’s a meaningfully long quiet stretch for a group this well-tracked, and it’s fair to describe current public visibility into APT33 activity as low rather than to assume the group has gone dormant — those are different claims, and only the first is supported by available evidence.
The Advisory That Isn’t About This Group
It’s worth being explicit about one source of potential confusion: CISA, the FBI, and the NSA published a joint advisory (AA26-097A) on April 7, 2026, updated July 22, 2026, describing Iranian-affiliated actors exploiting programmable logic controllers against US water, energy, and municipal infrastructure. That advisory attributes the activity to CyberAv3ngers — tracked elsewhere as the IRGC Cyber Electronic Command, or under the aliases Storm-0784 and UNC5691 — a group distinct from APT33/Peach Sandstorm. The two groups share an Iranian state nexus and a general industrial/critical-infrastructure interest, but nothing in the sourcing for either group ties this specific 2026 advisory to APT33. No 2026 sanctions or indictments naming APT33 specifically were identified either.
What This Means
APT33’s documented evolution — from 2017’s wiper-adjacent, aviation-focused operations to 2024’s cloud-infrastructure-abusing Tickler backdoor against a broader sector set — tracks a group that has kept adapting its tradecraft to wherever its targets’ infrastructure has moved. The thin 2025–2026 public record most likely reflects reduced visibility into the group’s current activity rather than a confirmed pause, and defenders in the sectors this group has previously targeted — energy, government, defense, satellite — shouldn’t read the quiet as reassurance. They should also be careful, when encountering 2026 Iranian-threat-actor advisories, to confirm which specific group is actually named before assuming it’s this one.