[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M797GSAZ4A2VCXCST1B1TDPF":3,"skill-same:01M797GSAZ4A2VCXCST1B1TDPF":51},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":33,"repositoryHtmlUrl":34,"repositoryHomepageUrl":6,"ownerHtmlUrl":35,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":36,"install":37,"resources":50},"01M797GSAZ4A2VCXCST1B1TDPF","apt33-elfin",null,"Adversary-emulation profile for APT33 (Elfin, Peach Sandstorm, HOLMIUM), a suspected Iranian state-sponsored espionage group, mapped to MITRE ATT&CK G0064 with Decepticon emulation guidance.","7ShIkI3\u002FDecepticon-x-DarkTriad","7ShIkI3","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F78133376?v=4","01M797CTK5AHH2161YVG93NJ3B","Raphael Pascaud","01M797CTKRQS64R01J7E6TJSEM",3,"Apache-2.0","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fshared\u002Fadversary-emulation\u002Fapt33-elfin\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: apt33-elfin\ndescription: \"Adversary-emulation profile for APT33 (Elfin, Peach Sandstorm, HOLMIUM), a suspected Iranian state-sponsored espionage group, mapped to MITRE ATT&CK G0064 with Decepticon emulation guidance.\"\nallowed-tools: Bash Read Write\nmetadata:\n  subdomain: adversary-emulation\n  when_to_use: \"APT33, Elfin, Peach Sandstorm, HOLMIUM, Refined Kitten, Iran, Iranian APT, G0064, aviation, energy, petrochemical, defense industrial base, satellite, password spray, FalseFont, Tickler, StoneDrill, Shamoon, .hta spearphishing, Azure abuse, AzureHound, Roadtools, WinRAR CVE-2018-20250, emulate Iranian espionage actor\"\n  tags: adversary-emulation, threat-intel, mitre-attack, apt33, iran, espionage, peach-sandstorm, password-spray, cloud, red-team\n  mitre_attack: T1071.001, T1560.001, T1547.001, T1110.003, T1059.001, T1059.005, T1555, T1555.003, T1132.001, T1573.001, T1546.003, T1048.003, T1203, T1068, T1105, T1040, T1571, T1027.013, T1588.002, T1003.001, T1003.004, T1003.005, T1566.001, T1566.002, T1053.005, T1552.001, T1552.006, T1204.001, T1204.002, T1078, T1078.004, T0852, T0853, T0865\n---\n\n# APT33 (Elfin, Peach Sandstorm, HOLMIUM) — Adversary Emulation Profile\n\nAPT33 (MITRE ATT&CK **G0064**; aliases Elfin, Peach Sandstorm, HOLMIUM) is a suspected Iranian state-sponsored threat group that has conducted cyber-espionage operations since at least 2013. The group is best known for spearphishing-driven intrusions against the aviation, energy, and petrochemical sectors in the United States, Saudi Arabia, and South Korea, and for an enduring evolution from `.hta`-based phishing toward large-scale cloud-identity attacks. Its operations blend publicly available offensive tooling with custom backdoors, and the group has been linked — with varying confidence — to destructive wiper malware. This profile maps APT33's documented TTPs to ATT&CK and provides emulation guidance for Decepticon under authorized engagement scope.\n\n## Attribution & motivation\n\n- **Suspected sponsor \u002F nation:** Iran. FireEye\u002FMandiant assessed APT33 works at the behest of the Iranian government and reported evidence linking the group to the Nasr Institute, an Iranian organization associated with cyber-warfare operations. Microsoft tracks the same actor as **Peach Sandstorm** and likewise attributes it to Iranian state interests.\n- **Primary motivation:** Strategic **espionage \u002F intelligence collection** aligned with Iranian state interests (aerospace, defense, energy). Microsoft assessed the 2023 password-spray campaign was likely intended to facilitate intelligence collection supporting Iranian state objectives.\n- **Secondary \u002F destructive dimension:** APT33 has been *linked* to the **StoneDrill** wiper, which shares similarities with the Shamoon family used against Saudi Aramco and RasGas (2012). Confidence on the destructive link is **lower than the espionage attribution** — Kaspersky and FireEye both noted it is unproven whether the Shamoon and StoneDrill operators are the same group or merely aligned in interests\u002Fregion. Treat any destructive capability claim as plausible-but-unconfirmed.\n- **Attribution confidence:** Moderate-to-high for Iranian state-sponsored espionage (multiple independent vendors converge: FireEye\u002FMandiant, Symantec, Microsoft). Lower for the destructive\u002Fwiper attribution.\n\n## Targeting\n\n- **Sectors:** Aviation (both military and commercial), energy with ties to petrochemical production (Mandiant 2017); chemical, engineering, manufacturing, consulting, finance, telecoms, research, and government (Symantec 2019). More recently: **satellite, defense, the Defense Industrial Base (DIB), pharmaceutical, communications, oil & gas, and government** (Microsoft 2023–2024).\n- **Regions:** Historically concentrated on **Saudi Arabia** (Symantec attributed ~42% of observed Elfin attacks since 2016) and the **United States** (including Fortune 500 firms), plus **South Korea**. Recent Peach Sandstorm campaigns are global, including the U.S. and UAE.\n- **Victim profile:** Organizations of strategic interest to Iran — aerospace\u002Fdefense contractors and supply-chain subcontractors, energy\u002Fpetrochemical operators, and satellite\u002Fcommunications providers. Spearphishing has often targeted individuals in aviation-related roles using recruitment\u002Fjob-themed lures.\n\n## Notable campaigns\n\n- **2016–mid 2017 — Aviation & petrochemical intrusions.** APT33 compromised a U.S. aviation organization and targeted a Saudi business conglomerate with aviation holdings and a South Korean oil-refining\u002Fpetrochemical company; May 2017 lures impersonated job vacancies at a Saudi petrochemical firm. (FireEye\u002FMandiant, \"APT33: Insights into Iranian Cyber Espionage,\" Sept 2017.)\n- **2017 — StoneDrill wiper discovery.** Kaspersky disclosed StoneDrill, a destructive wiper found in campaigns against Middle Eastern and European targets and linked to APT33-aligned activity, with conceptual similarities to Shamoon. (Kaspersky\u002FSecurelist, \"From Shamoon to StoneDrill,\" 2017.)\n- **Feb 2019 — Elfin \u002F WinRAR exploitation.** Symantec reported the Elfin (APT33) group attacked ~50 organizations across Saudi Arabia, the U.S., and other countries, and attempted to exploit **CVE-2018-20250** (WinRAR ACE) against a Saudi chemical-sector target. (Symantec, \"Elfin: Relentless Espionage Group,\" Mar 2019.)\n- **Feb–Jul 2023 — Peach Sandstorm password-spray.** Microsoft observed large-scale password-spray authentication attempts against thousands of organizations in satellite, defense, and pharmaceutical sectors, followed by Entra ID reconnaissance with AzureHound\u002FRoadtools on successful compromises. (Microsoft, \"Peach Sandstorm password spray campaigns,\" Sept 14 2023.)\n- **Nov–Dec 2023 — FalseFont backdoor against the DIB.** Microsoft observed Peach Sandstorm delivering the custom **FalseFont** backdoor to Defense Industrial Base organizations, enabling remote access, file launch, and C2 exfiltration. (Microsoft \u002F The Hacker News \u002F BleepingComputer, Dec 2023.)\n- **Apr–Jul 2024 — Tickler malware & Azure abuse.** Microsoft reported Peach Sandstorm deploying the custom multi-stage **Tickler** backdoor against satellite, communications, oil & gas, and U.S.\u002FUAE government targets, using fraudulent Azure subscriptions (compromised education-sector accounts) for Azure App Service C2 nodes, plus LinkedIn social engineering and SMB lateral movement. (Microsoft, \"Peach Sandstorm deploys new custom Tickler malware,\" Aug 28 2024.)\n\n## TTPs by ATT&CK tactic\n\n**Initial Access**\n- `T1566.001` — Spearphishing Attachment: archive attachments delivered in spearphishing emails.\n- `T1566.002` — Spearphishing Link: emails linking to malicious `.hta` HTML application files (recruitment\u002Fjob lures).\n- `T1110.003` — Password Spraying: large-scale spray against cloud\u002FInternet-facing auth to gain initial footholds (Peach Sandstorm 2023, low-and-slow with `go-http-client` UA).\n- `T1078` \u002F `T1078.004` — Valid Accounts (incl. Cloud Accounts): use of compromised credentials, including Office 365 \u002F Microsoft 365 accounts (historically with the Ruler tool).\n- `T1203` — Exploitation for Client Execution: WinRAR `CVE-2018-20250` and Outlook `CVE-2017-11774`.\n\n**Execution**\n- `T1059.001` — PowerShell: download payloads from C2 and run scripts.\n- `T1059.005` — Visual Basic: VBScript to initiate payload delivery.\n- `T1204.001` \u002F `T1204.002` — User Execution (Malicious Link \u002F Malicious File): luring users to click `.hta` links or open malicious attachments.\n\n**Persistence**\n- `T1547.001` — Registry Run Keys: used for DarkComet-style autostart persistence.\n- `T1546.003` — WMI Event Subscription: WMI subscriptions for persistence.\n- `T1053.005` — Scheduled Task: `.vbe` execution scheduled to run multiple times per day.\n\n**Privilege Escalation**\n- `T1068` — Exploitation for Privilege Escalation: `CVE-2017-0213`.\n- `T1078` — Valid Accounts also leveraged to operate at elevated\u002Flegitimate privilege.\n\n**Defense Evasion**\n- `T1132.001` — Standard Encoding: Base64-encoded C2 traffic.\n- `T1027.013` — Obfuscated\u002FEncoded File: Base64-encoded payloads.\n- (2024 Tickler) DLL sideloading via legitimate Windows binaries to blend persistence with trusted processes.\n\n**Credential Access**\n- `T1003.001` — LSASS Memory: LaZagne, Mimikatz, and ProcDump.\n- `T1003.004` — LSA Secrets: LaZagne.\n- `T1003.005` — Cached Domain Credentials: LaZagne.\n- `T1555` \u002F `T1555.003` — Credentials from Password Stores \u002F Web Browsers: LaZagne.\n- `T1040` — Network Sniffing: SniffPass for credential capture.\n- `T1552.001` — Credentials In Files: LaZagne file-based credential discovery.\n- `T1552.006` — Group Policy Preferences: Gpppassword to recover GPP-stored credentials.\n\n**Discovery**\n- Active Directory and Microsoft Entra ID reconnaissance: AzureHound (via Microsoft Graph \u002F Azure REST APIs) and Roadtools against cloud tenants after successful auth; AD snapshot extraction on-prem.\n\n**Lateral Movement**\n- SMB-based propagation across the network following initial compromise (Peach Sandstorm 2024); attempted deployment of AnyDesk remote management for access.\n\n**Collection**\n- `T1560.001` — Archive via Utility: WinRAR to compress data prior to exfiltration.\n- `T0852` (ICS) — Screen Capture: backdoor screenshot capability.\n\n**Command and Control**\n- `T1071.001` — Web Protocols: HTTP for C2.\n- `T1573.001` — Symmetric Cryptography: AES-encrypted C2 channel.\n- `T1571` — Non-Standard Port: HTTP over TCP ports 808 and 880.\n- `T1105` — Ingress Tool Transfer: download additional files\u002Fprograms from C2.\n- (2024) Azure App Service apps (e.g., `*.azurewebsites.net`) as C2 nodes under fraudulent Azure subscriptions.\n\n**Exfiltration**\n- `T1048.003` — Exfiltration Over Alternative Protocol: FTP for file exfiltration separate from the C2 channel.\n\n**Impact**\n- StoneDrill (`S0380`) wiper capability — destructive disk-wiping linked to APT33-aligned activity (attribution lower-confidence; conceptually related to Shamoon).\n\n**Resource Development \u002F ICS-adjacent**\n- `T1588.002` — Obtain Capabilities (Tool): acquisition of publicly available offensive tools.\n- `T0853` (ICS) — Scripting: PowerShell for C2 and file installation.\n- `T0865` (ICS) — Spearphishing Attachment: `.hta` files with embedded malicious code.\n\n## Signature tooling & malware\n\nCustom families: **TURNEDUP** (`S0198`\u002Fbackdoor — RAT, `S0199`), **NanoCore** (`S0336`), **NETWIRE** (`S0198`), **POWERTON** (`S0371`, PowerShell backdoor), **PoshC2** (`S0378`), **AutoIt backdoor** (`S0129`), **DEADWOOD** (`S1134`, 2019), **StoneDrill** (`S0380`, wiper), plus newer custom backdoors **FalseFont** (2023, DIB) and **Tickler** (2024, multi-stage Azure-backed). \n\nPublicly available \u002F dual-use: **Mimikatz** (`S0002`), **LaZagne** (`S0349`), **PowerSploit** (`S0194`), **Empire** (`S0363`), **Pupy** (`S0192`), **Ruler** (`S0358`, Outlook\u002FO365), **ftp** (`S0095`), **Net** (`S0039`), **ProcDump**, **SniffPass**, **Gpppassword**, **AzureHound**, **Roadtools**, and **AnyDesk** (abused RMM).\n\n## Emulation guidance (Decepticon)\n\n> Authorized-use only: execute these emulations strictly within the engagement's written scope, target list, and rules of engagement. Destructive\u002Fwiper TTPs must NEVER be executed against client systems — emulate Impact only via documented, reversible markers or out-of-scope-by-default.\n\nMap APT33's signature chain to Decepticon's own capabilities:\n\n- **Initial access — password spray (`T1110.003`) + cloud valid accounts (`T1078.004`):** This is the modern APT33 signature. Use Decepticon's cloud skills to run a low-and-slow spray against the engagement's M365\u002FEntra ID tenant with a custom user-agent and lockout-aware throttling, mirroring the `go-http-client` low-volume pattern. Pair with the engagement's authorized credential list. Avoid lockouts to stay in scope.\n- **Initial access — spearphishing (`T1566.001\u002F.002`, `T1204`):** If phishing is in scope, emulate `.hta`\u002Farchive-attachment lures with recruitment\u002Fjob themes via the engagement's sanctioned phishing harness; otherwise simulate the post-delivery effect by assuming a foothold.\n- **Execution \u002F staging (`T1059.001`, `T1105`):** Use Decepticon's bash\u002FPowerShell tooling to fetch and run a stager from your redirector, mirroring PowerShell download-and-execute.\n- **C2 — emulate with Sliver:** Stand up a Sliver HTTP listener (matches `T1071.001`), enable symmetric-crypto transport (`T1573.001`), and bind to non-standard ports analogous to 808\u002F880 (`T1571`). For high-fidelity cloud emulation, front C2 through an authorized Azure App Service \u002F `*.azurewebsites.net` redirector to replicate the Tickler infrastructure pattern — only with cloud-team approval.\n- **Cloud\u002FAD discovery (`AzureHound`\u002F`Roadtools`\u002FAD snapshot):** Use Decepticon's cloud and AD skills to enumerate Entra ID via Graph\u002FAzure REST (AzureHound-style) and pull an AD snapshot\u002FBloodHound collection on-prem — the exact recon APT33 runs post-auth.\n- **Credential access (`T1003.001\u002F.004\u002F.005`, `T1555`, `T1552.006`):** Via the defense-evasion \u002F credential workflow, emulate LSASS dumping (Mimikatz\u002FProcDump-style), LaZagne-style store harvesting, and GPP password recovery — log every artifact for the blue cell.\n- **Lateral movement (`T1078`, SMB):** Use Decepticon's lateral-movement skill for SMB-based propagation with recovered valid accounts; optionally emulate AnyDesk RMM deployment if RMM abuse is in scope.\n- **Collection & exfil (`T1560.001`, `T1048.003`):** Archive staged data with a WinRAR-equivalent utility, then exfiltrate over a *separate* FTP channel distinct from C2 to reproduce APT33's split-channel pattern.\n- **Defense evasion (`T1132.001`, `T1027.013`, DLL sideloading):** Base64-encode tasking\u002Fpayloads and emulate DLL sideloading against a benign legitimate binary to test the blue cell's sideload detection.\n- **Persistence (`T1547.001`, `T1546.003`, `T1053.005`):** Plant a Run-key, a WMI event subscription, and a recurring scheduled task (multiple daily triggers) as APT33 does — document each for clean teardown.\n\n## Detection & defense\n\n- **Password spray \u002F cloud identity (`T1110.003`, `T1078.004`):** Enforce phishing-resistant MFA, conditional access, and risk-based sign-in policies; alert on high-volume failed auth from single\u002Ffew source IPs, anomalous user-agents (e.g., `go-http-client`), and impossible-travel. Monitor for fraudulent Azure subscription creation and unexpected Azure App Service deployments.\n- **Spearphishing \u002F `.hta` (`T1566`, `T1204`):** Block\u002Finspect `.hta` and archive attachments at the gateway; disable `mshta.exe` where feasible; user-awareness on recruitment-themed lures.\n- **Exploits (`T1203`, `T1068`):** Patch WinRAR (CVE-2018-20250), Outlook (CVE-2017-11774), and Windows (CVE-2017-0213); restrict legacy archive utilities.\n- **Cloud\u002FAD recon (AzureHound\u002FRoadtools):** Monitor Microsoft Graph \u002F Azure REST enumeration spikes from newly authenticated principals; alert on bulk directory reads and AD snapshot\u002F`ntds`-style access.\n- **Credential access (`T1003.x`):** Enable LSASS protection (PPL\u002FCredential Guard), alert on ProcDump\u002FMimikatz LSASS handle access, and remediate GPP passwords (KB2962486).\n- **Persistence (`T1547.001`, `T1546.003`, `T1053.005`):** Baseline Run keys, WMI event subscriptions, and scheduled tasks; alert on `.vbe`\u002F`.hta`-spawned task creation.\n- **C2 \u002F exfil (`T1071.001`, `T1571`, `T1573.001`, `T1048.003`):** Inspect HTTP on non-standard ports (808\u002F880), flag long-lived beaconing to `*.azurewebsites.net` not tied to business use, and alert on outbound FTP to non-approved hosts.\n- **Lateral movement \u002F RMM:** Detect anomalous SMB admin-share writes and unauthorized AnyDesk\u002FRMM installation.\n- **Impact (wiper):** Maintain tested offline backups and EDR rules for mass file overwrite \u002F MBR tampering given the StoneDrill\u002FShamoon-adjacent risk.\n\n## Sources\n\n- https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0064\u002F\n- https:\u002F\u002Fwww.mandiant.com\u002Fresources\u002Fblog\u002Fapt33-insights-into-iranian-cyber-espionage\n- https:\u002F\u002Fsymantec-enterprise-blogs.security.com\u002Fblogs\u002Fthreat-intelligence\u002Felfin-apt33-espionage\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2023\u002F09\u002F14\u002Fpeach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets\u002F\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F08\u002F28\u002Fpeach-sandstorm-deploys-new-custom-tickler-malware-in-long-running-intelligence-gathering-operations\u002F\n- https:\u002F\u002Fthehackernews.com\u002F2023\u002F12\u002Fmicrosoft-warns-of-new-falsefont.html\n- https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmicrosoft-hackers-target-defense-firms-with-new-falsefont-malware\u002F\n- https:\u002F\u002Fsecurelist.com\u002Ffrom-shamoon-to-stonedrill\u002F77725\u002F\n- https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002FS0380\u002F\n","# APT33 (Elfin, Peach Sandstorm, HOLMIUM) — Adversary Emulation Profile\n\nAPT33 (MITRE ATT&CK **G0064**; aliases Elfin, Peach Sandstorm, HOLMIUM) is a suspected Iranian state-sponsored threat group that has conducted cyber-espionage operations since at least 2013. The group is best known for spearphishing-driven intrusions against the aviation, energy, and petrochemical sectors in the United States, Saudi Arabia, and South Korea, and for an enduring evolution from `.hta`-based phishing toward large-scale cloud-identity attacks. Its operations blend publicly available offensive tooling with custom backdoors, and the group has been linked — with varying confidence — to destructive wiper malware. This profile maps APT33's documented TTPs to ATT&CK and provides emulation guidance for Decepticon under authorized engagement scope.\n\n## Attribution & motivation\n\n- **Suspected sponsor \u002F nation:** Iran. FireEye\u002FMandiant assessed APT33 works at the behest of the Iranian government and reported evidence linking the group to the Nasr Institute, an Iranian organization associated with cyber-warfare operations. Microsoft tracks the same actor as **Peach Sandstorm** and likewise attributes it to Iranian state interests.\n- **Primary motivation:** Strategic **espionage \u002F intelligence collection** aligned with Iranian state interests (aerospace, defense, energy). Microsoft assessed the 2023 password-spray campaign was likely intended to facilitate intelligence collection supporting Iranian state objectives.\n- **Secondary \u002F destructive dimension:** APT33 has been *linked* to the **StoneDrill** wiper, which shares similarities with the Shamoon family used against Saudi Aramco and RasGas (2012). Confidence on the destructive link is **lower than the espionage attribution** — Kaspersky and FireEye both noted it is unproven whether the Shamoon and StoneDrill operators are the same group or merely aligned in interests\u002Fregion. Treat any destructive capability claim as plausible-but-unconfirmed.\n- **Attribution confidence:** Moderate-to-high for Iranian state-sponsored espionage (multiple independent vendors converge: FireEye\u002FMandiant, Symantec, Microsoft). Lower for the destructive\u002Fwiper attribution.\n\n## Targeting\n\n- **Sectors:** Aviation (both military and commercial), energy with ties to petrochemical production (Mandiant 2017); chemical, engineering, manufacturing, consulting, finance, telecoms, research, and government (Symantec 2019). More recently: **satellite, defense, the Defense Industrial Base (DIB), pharmaceutical, communications, oil & gas, and government** (Microsoft 2023–2024).\n- **Regions:** Historically concentrated on **Saudi Arabia** (Symantec attributed ~42% of observed Elfin attacks since 2016) and the **United States** (including Fortune 500 firms), plus **South Korea**. Recent Peach Sandstorm campaigns are global, including the U.S. and UAE.\n- **Victim profile:** Organizations of strategic interest to Iran — aerospace\u002Fdefense contractors and supply-chain subcontractors, energy\u002Fpetrochemical operators, and satellite\u002Fcommunications providers. Spearphishing has often targeted individuals in aviation-related roles using recruitment\u002Fjob-themed lures.\n\n## Notable campaigns\n\n- **2016–mid 2017 — Aviation & petrochemical intrusions.** APT33 compromised a U.S. aviation organization and targeted a Saudi business conglomerate with aviation holdings and a South Korean oil-refining\u002Fpetrochemical company; May 2017 lures impersonated job vacancies at a Saudi petrochemical firm. (FireEye\u002FMandiant, \"APT33: Insights into Iranian Cyber Espionage,\" Sept 2017.)\n- **2017 — StoneDrill wiper discovery.** Kaspersky disclosed StoneDrill, a destructive wiper found in campaigns against Middle Eastern and European targets and linked to APT33-aligned activity, with conceptual similarities to Shamoon. (Kaspersky\u002FSecurelist, \"From Shamoon to StoneDrill,\" 2017.)\n- **Feb 2019 — Elfin \u002F WinRAR exploitation.** Symantec reported the Elfin (APT33) group attacked ~50 organizations across Saudi Arabia, the U.S., and other countries, and attempted to exploit **CVE-2018-20250** (WinRAR ACE) against a Saudi chemical-sector target. (Symantec, \"Elfin: Relentless Espionage Group,\" Mar 2019.)\n- **Feb–Jul 2023 — Peach Sandstorm password-spray.** Microsoft observed large-scale password-spray authentication attempts against thousands of organizations in satellite, defense, and pharmaceutical sectors, followed by Entra ID reconnaissance with AzureHound\u002FRoadtools on successful compromises. (Microsoft, \"Peach Sandstorm password spray campaigns,\" Sept 14 2023.)\n- **Nov–Dec 2023 — FalseFont backdoor against the DIB.** Microsoft observed Peach Sandstorm delivering the custom **FalseFont** backdoor to Defense Industrial Base organizations, enabling remote access, file launch, and C2 exfiltration. (Microsoft \u002F The Hacker News \u002F BleepingComputer, Dec 2023.)\n- **Apr–Jul 2024 — Tickler malware & Azure abuse.** Microsoft reported Peach Sandstorm deploying the custom multi-stage **Tickler** backdoor against satellite, communications, oil & gas, and U.S.\u002FUAE government targets, using fraudulent Azure subscriptions (compromised education-sector accounts) for Azure App Service C2 nodes, plus LinkedIn social engineering and SMB lateral movement. (Microsoft, \"Peach Sandstorm deploys new custom Tickler malware,\" Aug 28 2024.)\n\n## TTPs by ATT&CK tactic\n\n**Initial Access**\n- `T1566.001` — Spearphishing Attachment: archive attachments delivered in spearphishing emails.\n- `T1566.002` — Spearphishing Link: emails linking to malicious `.hta` HTML application files (recruitment\u002Fjob lures).\n- `T1110.003` — Password Spraying: large-scale spray against cloud\u002FInternet-facing auth to gain initial footholds (Peach Sandstorm 2023, low-and-slow with `go-http-client` UA).\n- `T1078` \u002F `T1078.004` — Valid Accounts (incl. Cloud Accounts): use of compromised credentials, including Office 365 \u002F Microsoft 365 accounts (historically with the Ruler tool).\n- `T1203` — Exploitation for Client Execution: WinRAR `CVE-2018-20250` and Outlook `CVE-2017-11774`.\n\n**Execution**\n- `T1059.001` — PowerShell: download payloads from C2 and run scripts.\n- `T1059.005` — Visual Basic: VBScript to initiate payload delivery.\n- `T1204.001` \u002F `T1204.002` — User Execution (Malicious Link \u002F Malicious File): luring users to click `.hta` links or open malicious attachments.\n\n**Persistence**\n- `T1547.001` — Registry Run Keys: used for DarkComet-style autostart persistence.\n- `T1546.003` — WMI Event Subscription: WMI subscriptions for persistence.\n- `T1053.005` — Scheduled Task: `.vbe` execution scheduled to run multiple times per day.\n\n**Privilege Escalation**\n- `T1068` — Exploitation for Privilege Escalation: `CVE-2017-0213`.\n- `T1078` — Valid Accounts also leveraged to operate at elevated\u002Flegitimate privilege.\n\n**Defense Evasion**\n- `T1132.001` — Standard Encoding: Base64-encoded C2 traffic.\n- `T1027.013` — Obfuscated\u002FEncoded File: Base64-encoded payloads.\n- (2024 Tickler) DLL sideloading via legitimate Windows binaries to blend persistence with trusted processes.\n\n**Credential Access**\n- `T1003.001` — LSASS Memory: LaZagne, Mimikatz, and ProcDump.\n- `T1003.004` — LSA Secrets: LaZagne.\n- `T1003.005` — Cached Domain Credentials: LaZagne.\n- `T1555` \u002F `T1555.003` — Credentials from Password Stores \u002F Web Browsers: LaZagne.\n- `T1040` — Network Sniffing: SniffPass for credential capture.\n- `T1552.001` — Credentials In Files: LaZagne file-based credential discovery.\n- `T1552.006` — Group Policy Preferences: Gpppassword to recover GPP-stored credentials.\n\n**Discovery**\n- Active Directory and Microsoft Entra ID reconnaissance: AzureHound (via Microsoft Graph \u002F Azure REST APIs) and Roadtools against cloud tenants after successful auth; AD snapshot extraction on-prem.\n\n**Lateral Movement**\n- SMB-based propagation across the network following initial compromise (Peach Sandstorm 2024); attempted deployment of AnyDesk remote management for access.\n\n**Collection**\n- `T1560.001` — Archive via Utility: WinRAR to compress data prior to exfiltration.\n- `T0852` (ICS) — Screen Capture: backdoor screenshot capability.\n\n**Command and Control**\n- `T1071.001` — Web Protocols: HTTP for C2.\n- `T1573.001` — Symmetric Cryptography: AES-encrypted C2 channel.\n- `T1571` — Non-Standard Port: HTTP over TCP ports 808 and 880.\n- `T1105` — Ingress Tool Transfer: download additional files\u002Fprograms from C2.\n- (2024) Azure App Service apps (e.g., `*.azurewebsites.net`) as C2 nodes under fraudulent Azure subscriptions.\n\n**Exfiltration**\n- `T1048.003` — Exfiltration Over Alternative Protocol: FTP for file exfiltration separate from the C2 channel.\n\n**Impact**\n- StoneDrill (`S0380`) wiper capability — destructive disk-wiping linked to APT33-aligned activity (attribution lower-confidence; conceptually related to Shamoon).\n\n**Resource Development \u002F ICS-adjacent**\n- `T1588.002` — Obtain Capabilities (Tool): acquisition of publicly available offensive tools.\n- `T0853` (ICS) — Scripting: PowerShell for C2 and file installation.\n- `T0865` (ICS) — Spearphishing Attachment: `.hta` files with embedded malicious code.\n\n## Signature tooling & malware\n\nCustom families: **TURNEDUP** (`S0198`\u002Fbackdoor — RAT, `S0199`), **NanoCore** (`S0336`), **NETWIRE** (`S0198`), **POWERTON** (`S0371`, PowerShell backdoor), **PoshC2** (`S0378`), **AutoIt backdoor** (`S0129`), **DEADWOOD** (`S1134`, 2019), **StoneDrill** (`S0380`, wiper), plus newer custom backdoors **FalseFont** (2023, DIB) and **Tickler** (2024, multi-stage Azure-backed). \n\nPublicly available \u002F dual-use: **Mimikatz** (`S0002`), **LaZagne** (`S0349`), **PowerSploit** (`S0194`), **Empire** (`S0363`), **Pupy** (`S0192`), **Ruler** (`S0358`, Outlook\u002FO365), **ftp** (`S0095`), **Net** (`S0039`), **ProcDump**, **SniffPass**, **Gpppassword**, **AzureHound**, **Roadtools**, and **AnyDesk** (abused RMM).\n\n## Emulation guidance (Decepticon)\n\n> Authorized-use only: execute these emulations strictly within the engagement's written scope, target list, and rules of engagement. Destructive\u002Fwiper TTPs must NEVER be executed against client systems — emulate Impact only via documented, reversible markers or out-of-scope-by-default.\n\nMap APT33's signature chain to Decepticon's own capabilities:\n\n- **Initial access — password spray (`T1110.003`) + cloud valid accounts (`T1078.004`):** This is the modern APT33 signature. Use Decepticon's cloud skills to run a low-and-slow spray against the engagement's M365\u002FEntra ID tenant with a custom user-agent and lockout-aware throttling, mirroring the `go-http-client` low-volume pattern. Pair with the engagement's authorized credential list. Avoid lockouts to stay in scope.\n- **Initial access — spearphishing (`T1566.001\u002F.002`, `T1204`):** If phishing is in scope, emulate `.hta`\u002Farchive-attachment lures with recruitment\u002Fjob themes via the engagement's sanctioned phishing harness; otherwise simulate the post-delivery effect by assuming a foothold.\n- **Execution \u002F staging (`T1059.001`, `T1105`):** Use Decepticon's bash\u002FPowerShell tooling to fetch and run a stager from your redirector, mirroring PowerShell download-and-execute.\n- **C2 — emulate with Sliver:** Stand up a Sliver HTTP listener (matches `T1071.001`), enable symmetric-crypto transport (`T1573.001`), and bind to non-standard ports analogous to 808\u002F880 (`T1571`). For high-fidelity cloud emulation, front C2 through an authorized Azure App Service \u002F `*.azurewebsites.net` redirector to replicate the Tickler infrastructure pattern — only with cloud-team approval.\n- **Cloud\u002FAD discovery (`AzureHound`\u002F`Roadtools`\u002FAD snapshot):** Use Decepticon's cloud and AD skills to enumerate Entra ID via Graph\u002FAzure REST (AzureHound-style) and pull an AD snapshot\u002FBloodHound collection on-prem — the exact recon APT33 runs post-auth.\n- **Credential access (`T1003.001\u002F.004\u002F.005`, `T1555`, `T1552.006`):** Via the defense-evasion \u002F credential workflow, emulate LSASS dumping (Mimikatz\u002FProcDump-style), LaZagne-style store harvesting, and GPP password recovery — log every artifact for the blue cell.\n- **Lateral movement (`T1078`, SMB):** Use Decepticon's lateral-movement skill for SMB-based propagation with recovered valid accounts; optionally emulate AnyDesk RMM deployment if RMM abuse is in scope.\n- **Collection & exfil (`T1560.001`, `T1048.003`):** Archive staged data with a WinRAR-equivalent utility, then exfiltrate over a *separate* FTP channel distinct from C2 to reproduce APT33's split-channel pattern.\n- **Defense evasion (`T1132.001`, `T1027.013`, DLL sideloading):** Base64-encode tasking\u002Fpayloads and emulate DLL sideloading against a benign legitimate binary to test the blue cell's sideload detection.\n- **Persistence (`T1547.001`, `T1546.003`, `T1053.005`):** Plant a Run-key, a WMI event subscription, and a recurring scheduled task (multiple daily triggers) as APT33 does — document each for clean teardown.\n\n## Detection & defense\n\n- **Password spray \u002F cloud identity (`T1110.003`, `T1078.004`):** Enforce phishing-resistant MFA, conditional access, and risk-based sign-in policies; alert on high-volume failed auth from single\u002Ffew source IPs, anomalous user-agents (e.g., `go-http-client`), and impossible-travel. Monitor for fraudulent Azure subscription creation and unexpected Azure App Service deployments.\n- **Spearphishing \u002F `.hta` (`T1566`, `T1204`):** Block\u002Finspect `.hta` and archive attachments at the gateway; disable `mshta.exe` where feasible; user-awareness on recruitment-themed lures.\n- **Exploits (`T1203`, `T1068`):** Patch WinRAR (CVE-2018-20250), Outlook (CVE-2017-11774), and Windows (CVE-2017-0213); restrict legacy archive utilities.\n- **Cloud\u002FAD recon (AzureHound\u002FRoadtools):** Monitor Microsoft Graph \u002F Azure REST enumeration spikes from newly authenticated principals; alert on bulk directory reads and AD snapshot\u002F`ntds`-style access.\n- **Credential access (`T1003.x`):** Enable LSASS protection (PPL\u002FCredential Guard), alert on ProcDump\u002FMimikatz LSASS handle access, and remediate GPP passwords (KB2962486).\n- **Persistence (`T1547.001`, `T1546.003`, `T1053.005`):** Baseline Run keys, WMI event subscriptions, and scheduled tasks; alert on `.vbe`\u002F`.hta`-spawned task creation.\n- **C2 \u002F exfil (`T1071.001`, `T1571`, `T1573.001`, `T1048.003`):** Inspect HTTP on non-standard ports (808\u002F880), flag long-lived beaconing to `*.azurewebsites.net` not tied to business use, and alert on outbound FTP to non-approved hosts.\n- **Lateral movement \u002F RMM:** Detect anomalous SMB admin-share writes and unauthorized AnyDesk\u002FRMM installation.\n- **Impact (wiper):** Maintain tested offline backups and EDR rules for mass file overwrite \u002F MBR tampering given the StoneDrill\u002FShamoon-adjacent risk.\n\n## Sources\n\n- https:\u002F\u002Fattack.mitre.org\u002Fgroups\u002FG0064\u002F\n- https:\u002F\u002Fwww.mandiant.com\u002Fresources\u002Fblog\u002Fapt33-insights-into-iranian-cyber-espionage\n- https:\u002F\u002Fsymantec-enterprise-blogs.security.com\u002Fblogs\u002Fthreat-intelligence\u002Felfin-apt33-espionage\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2023\u002F09\u002F14\u002Fpeach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets\u002F\n- https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F08\u002F28\u002Fpeach-sandstorm-deploys-new-custom-tickler-malware-in-long-running-intelligence-gathering-operations\u002F\n- https:\u002F\u002Fthehackernews.com\u002F2023\u002F12\u002Fmicrosoft-warns-of-new-falsefont.html\n- https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmicrosoft-hackers-target-defense-firms-with-new-falsefont-malware\u002F\n- https:\u002F\u002Fsecurelist.com\u002Ffrom-shamoon-to-stonedrill\u002F77725\u002F\n- https:\u002F\u002Fattack.mitre.org\u002Fsoftware\u002FS0380\u002F\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"adversary-emulation, threat-intel, mitre-attack, apt33, iran, espionage, peach-sandstorm, password-spray, cloud, red-team","adversary-emulation","APT33, Elfin, Peach Sandstorm, HOLMIUM, Refined Kitten, Iran, Iranian APT, G0064, aviation, energy, petrochemical, defense industrial base, satellite, password spray, FalseFont, Tickler, StoneDrill, Shamoon, .hta spearphishing, Azure abuse, AzureHound, Roadtools, WinRAR CVE-2018-20250, emulate Iranian espionage actor","T1071.001, T1560.001, T1547.001, T1110.003, T1059.001, T1059.005, T1555, T1555.003, T1132.001, T1573.001, T1546.003, T1048.003, T1203, T1068, T1105, T1040, T1571, T1027.013, T1588.002, T1003.001, T1003.004, T1003.005, T1566.001, T1566.002, T1053.005, T1552.001, T1552.006, T1204.001, T1204.002, T1078, T1078.004, T0852, T0853, T0865","Bash Read Write","main","42b918525fb79065e730da3da997bffb33fcd414","packages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fshared\u002Fadversary-emulation\u002Fapt33-elfin",0,"https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad","https:\u002F\u002Fgithub.com\u002F7ShIkI3","2026-07-22 19:02:27",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add 7ShIkI3\u002FDecepticon-x-DarkTriad --skill apt33-elfin",{"tool":43,"command":44},"bunx","bunx skills add 7ShIkI3\u002FDecepticon-x-DarkTriad --skill apt33-elfin",{"tool":46,"command":47},"pnpm","pnpm dlx skills add 7ShIkI3\u002FDecepticon-x-DarkTriad --skill apt33-elfin","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fshared\u002Fadversary-emulation\u002Fapt33-elfin\u002FSKILL.md",true,[],[52,59,66,73,80,87],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":58,"publishedAt":19},"01M798TNHEBA4Y67TJJ7W0KBDD","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":19},"01M798TH79VR8XM7AAMG0ZKSXX","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":19},"01M798TD0E10ZHQN5X362M4HG9","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":19},"01M798T7HFR3NB9WJTK1FESVF9","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":19},"01M798T38B4SV0T87VQK56KPHC","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":19},"01M798SXTNF0RP1DXKQEWFVQ9H","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002F7ShIkI3\u002FDecepticon-x-DarkTriad\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]