APT / StateG0064

APT33

Also known as: ATK35, BLEAK ION, COBALT TRINITY, Elfin, G0064, HOLMIUM and 4 more

E-mail alert on newly attributed CVEs, new victims in Brazil and verified incidents.

About the group

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity63

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 31

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Tool

Initial access

Spearphishing Attachment Spearphishing Link

Execution

Scheduled Task PowerShell Visual Basic Exploitation for Client Execution Malicious Link Malicious File

Persistence

Registry Run Keys / Startup Folder

Privilege escalation

Exploitation for Privilege Escalation Windows Management Instrumentation Event Subscription

Credential access

LSASS Memory LSA Secrets Cached Domain Credentials Network Sniffing Password Spraying Credentials In Files Group Policy Preferences Credentials from Password Stores Credentials from Web Browsers

Collection

Archive via Utility

Command and control

Web Protocols Ingress Tool Transfer Standard Encoding Non-Standard Port Symmetric Cryptography

Exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

stealth

Encrypted/Encoded File Valid Accounts Cloud Accounts

Exploited vulnerabilities 4

CVEs this group is known to exploit, with the source and confidence of each next to it. Ordered by confidence and real-world severity.

CVE-2018-20250HIGHEPSS 96%KEV MITRE ATT&CK

CVE-2017-0213HIGHEPSS 84%KEV MITRE ATT&CK

CVE-2014-6352HIGHEPSS 77%KEV MITRE ATT&CK

CVE-2017-11774HIGHEPSS 60%KEV MITRE ATT&CK

Known infrastructure 61

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

sha256_hash8bd40f06c025a2d2f8ff739309b40a6f551617c9d5cb28544480260b50cb09c1NanoCoremalwarebazaar

sha256_hashf7e8e61cbce426555822b337eac7560747e35b16799a4bab39abad9025464351NanoCoremalwarebazaar

ip:port143.110.219.27:8447PoshC2threatfox

sha256_hash19fa4f937f168683c93957ef60bad3e80a7405cad020ae46e05457a197a7274bNanoCoremalwarebazaar

sha256_hash352cfb22ba4830b5c184041bf4457a21580e44bdfa66f615e003799c3a76fc97NanoCoremalwarebazaar

sha256_hashd0c49323ffadf825f022fd40f36772c7665d0f548a341d43347318e183fd42d6NanoCoremalwarebazaar

sha256_hash565d2bcc2a67aa9b857105f48cd4df7194239a8725137c0c3c1ec32211fc49ebNanoCoremalwarebazaar

sha256_hash853f51dcb039588ee4b606b131da01658a52cd7f642a5a37237db909c8b14ca0NanoCoremalwarebazaar

sha256_hashe4a0ae51bfb8c95e58f31833caad95888ea60447d3f4f6991de42d6e8f597005NanoCoremalwarebazaar

sha256_hash09f7d2a30633ca2ea229ae07d447819d96c19f1466021fb9c46a1fd241cf4ecfNanoCoremalwarebazaar

sha256_hashceff4e55a0f6d0a0bd19984b46a7c219fa831421c80349e99d42969d63d95a6eNanoCoremalwarebazaar

ip:port89.127.233.103:443PoshC2threatfox

sha256_hash95cca0c53fb872f2133364e7590d816a39983bf7aacab30768472cd45845ddfbNanoCoremalwarebazaar

ip:port143.110.219.27:8448PoshC2threatfox

sha256_hash17ed40dea218bde06337f32e3d3443d07fd24cad9b0da82d6d890716ac6308ffNanoCoremalwarebazaar

sha256_hash00d3d01d3a9eb2ff54c6a621f9fe2d6d8671930ad2e941f961f841b53f565605NanoCoremalwarebazaar

sha256_hash88d8d876d344e45ca794430176f9b52792e533e13a1abcfa5fd13d43f87bb777NanoCoremalwarebazaar

ip:port143.110.219.27:8445PoshC2threatfox

ip:port143.110.219.27:4433PoshC2threatfox

ip:port143.110.219.27:4443PoshC2threatfox

sha256_hash41bf4c830222866a7f4d795937574fb21a4e1a03fc5cb7a80c5399946b01f0ebNanoCoremalwarebazaar

sha256_hash063a716290fe030ad8fc767c7e47ec7e57b26cce7e3c7f466434f07572100a8aNanoCoremalwarebazaar

md5_hash898d994607ccd834cdbddc7fb4cc8242MimiKatzthreatfox

sha1_hash97479f00486752b22b3d19feffde5fc4e23c615fMimiKatzthreatfox

sha256_hash46deeb93c5d7be110d5459abc663ab8edc4bf2d8e098e0d3e96f613205d556f9MimiKatzthreatfox

sha256_hash51ef4a7863a921980f5c3f3522449faaf851c5a6c3f1c12e8cf186ce593f6753NanoCoremalwarebazaar

ip:port143.110.219.27:443PoshC2threatfox

ip:port146.190.247.89:8080PoshC2threatfox

ip:port143.110.219.27:8080PoshC2threatfox

ip:port161.35.58.0:443PoshC2threatfox

+61 indicators in total. See them all on the IOCs page.

References

APT33 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →