APT33
Associated Group Descriptions
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1546 | .003 | 事件触发执行: Windows Management Instrumentation Event Subscription |
APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.[3] |
| Enterprise | T1555 | 从密码存储中获取凭证 |
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[4][6] |
|
| .003 | Credentials from Web Browsers |
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[4][6] |
||
| Enterprise | T1573 | .001 | 加密通道: Symmetric Cryptography |
APT33 has used AES for encryption of command and control traffic.[6] |
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.[4][3] |
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
APT33 has utilized PowerShell to download files from the C2 server and run various scripts. [4][3] |
| .005 | 命令与脚本解释器: Visual Basic |
APT33 has used VBScript to initiate the delivery of payloads.[3] |
||
| Enterprise | T1203 | 客户端执行漏洞利用 |
APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).[4][3] |
|
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols | |
| Enterprise | T1560 | .001 | 归档收集数据: Archive via Utility | |
| Enterprise | T1003 | .001 | 操作系统凭证转储: LSASS Memory |
APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.[4][6] |
| .004 | 操作系统凭证转储: LSA Secrets |
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[4][6] |
||
| .005 | 操作系统凭证转储: Cached Domain Credentials |
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[4][6] |
||
| Enterprise | T1132 | .001 | 数据编码: Standard Encoding |
APT33 has used base64 to encode command and control traffic.[6] |
| Enterprise | T1110 | .003 | 暴力破解: Password Spraying |
APT33 has used password spraying to gain access to target systems.[6][3] |
| Enterprise | T1048 | .003 | 替代协议渗出: Exfiltration Over Unencrypted Non-C2 Protocol |
APT33 has used FTP to exfiltrate files (separately from the C2 channel).[4] |
| Enterprise | T1078 | 有效账户 |
APT33 has used valid accounts for initial access and privilege escalation.[2][6] |
|
| .004 | Cloud Accounts |
APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.[3] |
||
| Enterprise | T1552 | .001 | 未加密凭证: Credentials In Files |
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.[4][6] |
| .006 | 未加密凭证: Group Policy Preferences |
APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.[4][6] |
||
| Enterprise | T1068 | 权限提升漏洞利用 |
APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.[6] |
|
| Enterprise | T1027 | .013 | 混淆文件或信息: Encrypted/Encoded File | |
| Enterprise | T1204 | .001 | 用户执行: Malicious Link |
APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.[1][4] |
| .002 | 用户执行: Malicious File |
APT33 has used malicious e-mail attachments to lure victims into executing malware.[3] |
||
| Enterprise | T1040 | 网络嗅探 |
APT33 has used SniffPass to collect credentials by sniffing network traffic.[4] |
|
| Enterprise | T1588 | .002 | 获取能力: Tool |
APT33 has obtained and leveraged publicly-available tools for early intrusion activities.[6][4] |
| Enterprise | T1105 | 输入工具传输 |
APT33 has downloaded additional files and programs from its C2 server.[4][3] |
|
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
APT33 has sent spearphishing e-mails with archive attachments.[3] |
| .002 | 钓鱼: Spearphishing Link |
APT33 has sent spearphishing emails containing links to .hta files.[1][4] |
||
| Enterprise | T1571 | 非标准端口 |
APT33 has used HTTP over TCP ports 808 and 880 for command and control.[4] |
|
| Enterprise | T1053 | .005 | 预定任务/作业: Scheduled Task |
APT33 has created a scheduled task to execute a .vbe file multiple times a day.[4] |
| ICS | T0852 | Screen Capture |
APT33 utilize backdoors capable of capturing screenshots once installed on a system. [7][8] |
|
| ICS | T0853 | Scripting |
APT33 utilized PowerShell scripts to establish command and control and install files for execution. [9] [10] |
|
| ICS | T0865 | Spearphishing Attachment |
APT33 sent spear phishing emails containing links to HTML application files, which were embedded with malicious code. [7] APT33 has conducted targeted spear phishing campaigns against U.S. government agencies and private sector companies. [11] |
|
Software
References
- O'Leary, J., et al. (2017, September 20). Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware. Retrieved February 15, 2018.
- Davis, S. and Carr, N. (2017, September 21). APT33: New Insights into Iranian Cyber Espionage Group. Retrieved February 15, 2018.
- Microsoft Threat Protection Intelligence Team. (2020, June 18). Inside Microsoft Threat Protection: Mapping attack chains from cloud to endpoint. Retrieved June 22, 2020.
- Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
- Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
- Ackerman, G., et al. (2018, December 21). OVERRULED: Containing a Potentially Destructive Adversary. Retrieved January 17, 2019.
- Jacqueline O'Leary et al. 2017, September 20 Insights into Iranian Cyber Espionage: APT33 Targets Aerospace and Energy Sectors and has Ties to Destructive Malware Retrieved. 2019/12/02
- Junnosuke Yagi 2017, March 07 Trojan.Stonedrill Retrieved. 2019/12/05
- Symantec 2019, March 27 Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S. Retrieved. 2019/12/02
- Dragos Symantec 2019, March 27 Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S. Retrieved. 2019/12/02 Magnallium Retrieved. 2019/10/27
- Andy Greenburg 2019, June 20 Iranian Hackers Launch a New US-Targeted Campaign as Tensions Mount Retrieved. 2020/01/03
- INSIKT GROUP. (2020, January 7). Iranian Cyber Response to Death of IRGC Head Would Likely Use Reported TTPs and Previous Access. Retrieved May 22, 2024.