Home › Threat Actors › APT33
← All Threat Actors
Nation-State medium Iran

APT33

Mandiant/FireEye assesses APT33 operates at the Iranian government's behest, with reported ties to the Nasr Institute. MITRE ATT&CK G0064. · Espionage, with disputed/lower-confidence links to destructive wiper activity

Reports 1
Active Since At least 2013
Last Reported 2 Oct 2026
Sectors Targeted energy, government, aerospace-defense, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • 2017: DROPSHOT dropper (tracked by Kaspersky as StoneDrill), SHAPESHIFT wiper, TURNEDUP custom backdoor
  • Fake aviation job postings delivered via malicious .hta files (targets included Boeing, Alsalam Aircraft, Northrop Grumman Aviation Arabia)
  • 2024 (as Peach Sandstorm): Tickler, a custom multi-stage backdoor using fraudulent attacker-controlled Azure subscriptions for C2

Known Targets

US, Saudi Arabia, South Korea — particular interest in aviation and energy (MITRE)Private-sector aviation, energy, petrochemical (CFR)2023–2024 (Peach Sandstorm): satellite, defense industrial base, pharmaceutical, government, oil & gas in the US and UAE

Analyst Notes

Shamoon/StoneDrill wiper attribution is disputed — Kaspersky found only stylistic similarities between StoneDrill and Shamoon, not proof of a shared operator; confidence here is lower than for the group's core espionage activity. A claimed VSTO-based dropper was not found in any source and should be treated as unconfirmed. Most recent confirmed activity is the April–July 2024 Tickler campaign; no dedicated APT33/Peach Sandstorm-specific campaign or advisory dated after a November 2025 Brandefense forecast was identified. CISA's AA26-097A (Apr/Jul 2026, Iranian PLC exploitation of US water/energy infrastructure) is attributed to the distinct group CyberAv3ngers, not APT33 — do not conflate.

Also Known As

HOLMIUMElfinPeach Sandstorm (Microsoft, current designation)

MITRE ATT&CK Techniques

T1110.003 Brute Force: Password Spraying T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing Link T1078.004 Valid Accounts: Cloud Accounts T1003.001 OS Credential Dumping: LSASS Memory T1546.003 Event Triggered Execution: WMI Event Subscription

Intelligence Reports

Commentary energygovernment

APT33 Went Quiet After Tickler. That Probably Doesn't Mean What You'd Hope

Microsoft's Peach Sandstorm (APT33) was last seen running a custom backdoor through fraudulent Azure subscriptions against US and UAE targets in mid-2024. The trail goes cold after a late-2025 forecast report — and a similarly-named 2026 CISA advisory about Iranian hackers is a different group entirely.

2 Oct 2026 · 6 min read