APT33 (Peach Sandstorm) is a suspected Iranian threat group active since at least 2013, focused on aviation, defense, energy, and oil-and-gas targets in Saudi Arabia, the wider Gulf, and the United States, with a history linking espionage access to destructive capability.
APT33 was first documented by FireEye in 2017 for operations dating to at least 2013. The group is assessed as Iranian and is widely linked to Iranian military/IRGC interests, though public attribution to a specific service remains less definitive than for MOIS clusters like OilRig or MuddyWater. Microsoft tracks the actor as Peach Sandstorm.
Historically APT33 combined password-spraying and credential-harvesting against cloud and enterprise accounts with custom malware, and it maintained links to destructive tooling (the SHAPESHIFT/StoneDrill wiper lineage), giving it a dual espionage-and-sabotage posture that distinguishes it from purely intelligence-driven peers.
The Gulf is APT33's principal target region. Saudi Arabia — particularly aviation and energy/petrochemical organizations — has been a persistent focus, alongside U.S. and South Korean entities in the same verticals. This targeting aligns closely with Iranian strategic and economic-rivalry interests in the Gulf.
APT33 remains active into 2025–2026. In August 2024 Microsoft detailed a custom multi-stage backdoor, Tickler, deployed April–July 2024 against satellite, communications, oil-and-gas, and government targets in the U.S. and UAE, using fraudulently created attacker-controlled Azure subscriptions for C2. Subsequent reporting describes continued Tickler activity in the UAE and broader Gulf and assesses APT33 as retaining a high-risk dual posture in which espionage footholds in aerospace and energy networks could be repurposed for wiper deployment during Iranian escalation.
| Technique | Name | Tactic | Observed use |
|---|---|---|---|
| T1560.001 ↗ | Archive Collected Data: Archive via Utility | collection | APT33 has used WinRAR to compress data prior to exfil. |
| T0852 ↗ | Screen Capture (ICS) | collection (ICS) | APT33 utilizes backdoors capable of capturing screenshots. |
| T1071.001 ↗ | Application Layer Protocol: Web Protocols | command and control | APT33 has used HTTP for command and control. |
| T1132.001 ↗ | Data Encoding: Standard Encoding | command and control | APT33 has used base64 to encode command and control traffic. |
| T1105 ↗ | Ingress Tool Transfer | command and control | APT33 has downloaded additional files and programs from its C2 server. |
| T1573.001 ↗ | Encrypted Channel: Symmetric Cryptography | command and control | APT33 has used AES for encryption of command and control traffic. |
| T1571 ↗ | Non-Standard Port | command and control | APT33 has used HTTP over TCP ports 808 and 880 for command and control. |
| T1110.003 ↗ | Brute Force: Password Spraying | credential access | APT33 has used password spraying to gain access to target systems. |
| T1003.005 ↗ | OS Credential Dumping: Cached Domain Credentials | credential access | APT33 has used LaZagne to gather cached domain credentials. |
| T1003.001 ↗ | OS Credential Dumping: LSASS Memory | credential access | APT33 used LaZagne, Mimikatz, and ProcDump to dump credentials. |
| T1003.004 ↗ | OS Credential Dumping: LSA Secrets | credential access | APT33 has used LaZagne to gather credentials from LSA Secrets. |
| T1552.001 ↗ | Unsecured Credentials: Credentials In Files | credential access | APT33 used LaZagne to gather credentials stored in files. |
| T1552.006 ↗ | Unsecured Credentials: Group Policy Preferences | credential access | APT33 used Gpppassword to gather credentials from Group Policy. |
| T1555 ↗ | Credentials from Password Stores | credential access | APT33 has used publicly available tools like LaZagne to gather credentials. |
| T1555.003 ↗ | Credentials from Password Stores: Credentials from Web Browsers | credential access | APT33 has used LaZagne to gather credentials from web browsers. |
| T1040 ↗ | Network Sniffing | credential access, discovery | APT33 has used SniffPass to collect credentials by sniffing network traffic. |
| T1203 ↗ | Exploitation for Client Execution | execution | APT33 exploited WinRAR vulnerability CVE-2018-20250 and CVE-2017-11774. |
| T1059.001 ↗ | Command and Scripting Interpreter: PowerShell | execution | APT33 has utilized PowerShell to download files from C2 and run scripts. |
| T1059.005 ↗ | Command and Scripting Interpreter: Visual Basic | execution | APT33 has used VBScript to initiate the delivery of payloads. |
| T1204.001 ↗ | User Execution: Malicious Link | execution | APT33 lured users to click malicious HTML app links via spearphishing. |
| T1204.002 ↗ | User Execution: Malicious File | execution | APT33 used malicious e-mail attachments to lure victims into execution. |
| T0853 ↗ | Scripting (ICS) | execution (ICS) | APT33 utilized PowerShell scripts for C2 and file installation. |
| T1053.005 ↗ | Scheduled Task/Job: Scheduled Task | execution, persistence, privilege escalation | APT33 created a scheduled task to execute a .vbe file multiple times daily. |
| T1048.003 ↗ | Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol | exfiltration | APT33 has used FTP to exfiltrate files separately from the C2 channel. |
| T1566.001 ↗ | Phishing: Spearphishing Attachment | initial access | APT33 has sent spearphishing e-mails with archive attachments. |
| T1566.002 ↗ | Phishing: Spearphishing Link | initial access | APT33 has sent spearphishing emails containing links to .hta files. |
| T0865 ↗ | Spearphishing Attachment (ICS) | initial access (ICS) | APT33 sent spearphishing emails with malicious HTML application links. |
| T1078 ↗ | Valid Accounts | initial access, persistence, privilege escalation, stealth | APT33 has used valid accounts for initial access and escalation. |
| T1078.004 ↗ | Valid Accounts: Cloud Accounts | initial access, persistence, privilege escalation, stealth | APT33 used compromised Office 365 accounts with Ruler for endpoint control. |
| T1547.001 ↗ | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | persistence, privilege escalation | APT33 has deployed DarkComet to the Startup folder and used Registry run keys for persistence. |
| T1546.003 ↗ | Event Triggered Execution: Windows Management Instrumentation Event Subscription | persistence, privilege escalation | APT33 has attempted to use WMI event subscriptions for persistence. |
| T1068 ↗ | Exploitation for Privilege Escalation | privilege escalation | APT33 has used a public exploit for CVE-2017-0213 to escalate privileges. |
| T1588.002 ↗ | Obtain Capabilities: Tool | resource development | APT33 has obtained and leveraged publicly-available tools for early intrusion. |
| T1027.013 ↗ | Obfuscated Files or Information: Encrypted/Encoded File | stealth | APT33 has used base64 to encode payloads. |