Elfin Team
Advanced Persistent Threat 33 (APT33) is a hacker group identified by FireEye as being supported by the government of Iran.[1][2] The group has also been called Elfin Team, Refined Kitten (by Crowdstrike), Magnallium (by Dragos), Peach Sandstorm,[3] and Holmium (by Microsoft).[4][5][6] It is categorized as an advanced persistent threat.
History
[edit | edit source]FireEye believes that the group was formed no later than 2013.[1]
Targets
[edit | edit source]APT33 has reportedly targeted aerospace, defense and petrochemical industry targets in the United States, South Korea, and Saudi Arabia.[1][2]
Modus operandi
[edit | edit source]APT33 reportedly uses a dropper program designated DropShot, which can deploy a wiper called ShapeShift, or install a backdoor called TurnedUp.[1] The group is reported to use the ALFASHELL tool to send spear-phishing emails loaded with malicious HTML Application files to its targets.[1][2]
APT33 registered domains impersonating many commercial entities, including Boeing, Alsalam Aircraft Company, Northrop Grumman and Vinnell.[2]
Identification
[edit | edit source]FireEye and Kaspersky Lab noted similarities between the ShapeShift and Shamoon, another virus linked to Iran.[1] APT33 also used Farsi in ShapeShift and DropShot, and was most active during Iran Standard Time business hours, remaining inactive on the Iranian weekend.[1][2]
One hacker known by the pseudonym of xman_1365_x was linked to both the TurnedUp tool code and the Iranian Nasr Institute, which has been connected to the Iranian Cyber Army.[7][1][2][8] xman_1365_x has accounts on Iranian hacker forums, including Shabgard and Ashiyane.[7]
See also
[edit | edit source]References
[edit | edit source]- ^ a b c d e f g h Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ a b c d e f Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ a b Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).
- ^ Lua error in Module:Citation/CS1/Configuration at line 2172: attempt to index field '?' (a nil value).