Trusted Design

APT33

G0064 · MITRE Pageへのリンク

脅威アクターの詳細

[APT33](https://attack.mitre.org/groups/G0064) is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors.(Citation: FireEye APT33 Sept 2017)(Citation: FireEye APT33 Webinar Sept 2017)

別名・別称

APT33
HOLMIUM
Elfin
Peach Sandstorm

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1132.001 - Standard Encoding
• T1027.013 - Encrypted/Encoded File
• T1003.004 - LSA Secrets
• T1204.002 - Malicious File
• T1573.001 - Symmetric Cryptography
• T1566.002 - Spearphishing Link
• T1566.001 - Spearphishing Attachment
• T1040 - Network Sniffing
• T1555 - Credentials from Password Stores
• T1555.003 - Credentials from Web Browsers
• T1003.001 - LSASS Memory
• T1110.003 - Password Spraying
• T1003.005 - Cached Domain Credentials
• T1552.001 - Credentials In Files
• T1552.006 - Group Policy Preferences
• T1546.003 - Windows Management Instrumentation Event Subscription
• T1059.001 - PowerShell
• T1547.001 - Registry Run Keys / Startup Folder
• T1588.002 - Tool
• T1078 - Valid Accounts
• T1571 - Non-Standard Port
• T1068 - Exploitation for Privilege Escalation
• T1203 - Exploitation for Client Execution
• T1071.001 - Web Protocols
• T1059.005 - Visual Basic
• T1105 - Ingress Tool Transfer
• T1204.001 - Malicious Link
• T1078.004 - Cloud Accounts
• T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1203)
• CVE-2015-5749 (T1552.001)
• CVE-2016-1898 (T1204.001)
• CVE-2016-1897 (T1204.001)
• CVE-2015-7261 (T1204.001)
• CVE-2015-6036 (T1204.001)
• CVE-2015-7262 (T1068)
• CVE-2015-0932 (T1552.001)
• CVE-2010-3081 (T1068)
• CVE-2017-16929 (T1204.001)
• CVE-2025-31125 (T1204.001)
• CVE-2025-68645 (T1204.001)
• CVE-2016-6532 (T1552.006)
• CVE-2008-1436 (T1068)
• CVE-2010-4398 (T1204.001)
• CVE-2014-4114 (T1204.001)
• CVE-2015-1770 (T1204.001)
• CVE-2015-2545 (T1204.001)
• CVE-2017-0199 (T1204.001)
• CVE-2012-0158 (T1204.001)
• CVE-2013-3906 (T1203)
• CVE-2014-6352 (T1059.005)
• CVE-2015-0016 (T1204.001)
• CVE-2010-3333 (T1204.001)
• CVE-2010-0188 (T1204.001)
• CVE-2010-2884 (T1068)
• CVE-2013-0640 (T1204.002)
• CVE-2011-0611 (T1203)
• CVE-2015-0071 (T1204.001)
• CVE-2010-1553 (T1204.001)
• CVE-2014-1761 (T1203)
• CVE-2015-2853 (T1204.001)
• CVE-2012-1876 (T1204.001)
• CVE-2012-2539 (T1204.001)
• CVE-2013-3660 (T1204.001)
• CVE-2013-7331 (T1078)
• CVE-2009-3129 (T1204.001)
• CVE-2013-5990 (T1204.001)
• CVE-2015-7645 (T1204.001)
• CVE-2015-3043 (T1204.001)
• CVE-2016-1010 (T1204.001)
• CVE-2016-1001 (T1203)
• CVE-2016-0998 (T1204.001)
• CVE-2016-9494 (T1204.001)
• CVE-2016-9496 (T1204.001)
• CVE-2016-9495 (T1204.001)
• CVE-2017-0261 (T1204.001)
• CVE-2015-0311 (T1204.001)
• CVE-2015-0336 (T1204.001)
• CVE-2015-0310 (T1203)
• CVE-2014-0556 (T1204.001)
• CVE-2014-8440 (T1204.001)
• CVE-2010-1297 (T1204.001)
• CVE-2013-0634 (T1040)
• CVE-2014-0329 (T1204.001)
• CVE-2015-8286 (T1555)
• CVE-2016-2343 (T1555.003)
• CVE-2012-0507 (T1204.001)
• CVE-2014-3393 (T1555)
• CVE-2015-2546 (T1204.001)
• CVE-2015-3785 (T1555.003)
• CVE-2015-5897 (T1068)
• CVE-2015-3456 (T1078)
• CVE-2013-2094 (T1204.001)
• CVE-2014-4113 (T1204.001)
• CVE-2015-8562 (T1204.001)
• CVE-2016-1990 (T1068)
• CVE-2016-1991 (T1068)
• CVE-2015-1701 (T1204.001)
• CVE-2015-3628 (T1203)
• CVE-2015-6034 (T1068)
• CVE-2015-6022 (T1204.001)
• CVE-2016-1562 (T1555.003)
• CVE-2017-0263 (T1204.001)
• CVE-2012-0056 (T1068)
• CVE-2012-1258 (T1068)
• CVE-2014-3153 (T1203)
• CVE-2015-3636 (T1068)
• CVE-2013-6282 (T1555.003)
• CVE-2015-0057 (T1204.001)
• CVE-2015-1761 (T1204.001)
• CVE-2015-2360 (T1204.001)
• CVE-2014-6324 (T1204.001)
• CVE-2010-0232 (T1204.001)
• CVE-2014-2273 (T1555.003)
• CVE-2015-2387 (T1204.001)
• CVE-2017-0001 (T1204.001)
• CVE-2025-13335 (T1571)
• CVE-2025-13927 (T1078)
• CVE-2025-13928 (T1078)
• CVE-2025-24893 (T1204.001)
• CVE-2026-1102 (T1078)
• CVE-2026-20127 (T1204.001)
• CVE-2015-7755 (T1203)
• CVE-2015-6585 (T1552.001)
• CVE-2014-7247 (T1204.001)
• CVE-2013-2678 (T1204.001)
• CVE-2025-54313 (T1552.001)
• CVE-2012-4969 (T1204.001)
• CVE-2012-1856 (T1204.001)
• CVE-2015-7808 (T1203)
• CVE-2016-1019 (T1078)
• CVE-2014-4322 (T1068)
• CVE-2012-4681 (T1204.001)
• CVE-2014-1776 (T1204.001)
• CVE-2010-0738 (T1078)
• CVE-2012-6422 (T1068)
• CVE-2013-2595 (T1068)
• CVE-2011-1255 (T1204.001)
• CVE-2023-1389 (T1204.001)
• CVE-2025-55183 (T1204.001)
• CVE-2015-5119 (T1204.001)
• CVE-2015-5122 (T1204.001)
• CVE-2015-3090 (T1204.001)
• CVE-2015-3113 (T1203)
• CVE-2015-2590 (T1204.001)
• CVE-2015-2502 (T1204.001)
• CVE-2014-6271 (T1204.001)
• CVE-2016-0984 (T1204.001)
• CVE-2015-0313 (T1204.001)
• CVE-2015-0359 (T1204.001)
• CVE-2015-5130 (T1204.001)
• CVE-2015-5134 (T1204.001)
• CVE-2015-5539 (T1204.001)
• CVE-2015-5557 (T1204.001)
• CVE-2015-5563 (T1204.001)
• CVE-2015-5559 (T1204.001)
• CVE-2015-5540 (T1204.001)
• CVE-2015-5561 (T1204.001)
• CVE-2015-5551 (T1204.001)
• CVE-2015-5564 (T1204.001)
• CVE-2015-5565 (T1204.001)
• CVE-2015-5550 (T1204.001)
• CVE-2015-5566 (T1204.001)
• CVE-2015-5127 (T1204.001)
• CVE-2015-5556 (T1204.001)
• CVE-2016-1287 (T1068)
• CVE-2017-0262 (T1204.001)
• CVE-2012-0611 (T1204.001)
• CVE-2014-6332 (T1204.001)
• CVE-2015-2852 (T1204.001)
• CVE-2015-2854 (T1204.001)
• CVE-2015-8287 (T1203)
• CVE-2012-3213 (T1204.001)
• CVE-2012-4792 (T1204.001)
• CVE-2014-0322 (T1204.001)
• CVE-2015-3105 (T1203)
• CVE-2014-0497 (T1203)
• CVE-2014-8361 (T1071.001)
• CVE-2013-0074 (T1204.001)
• CVE-2013-2551 (T1204.001)
• CVE-2014-0515 (T1203)
• CVE-2014-9163 (T1203)
• CVE-2010-0806 (T1204.001)
• CVE-2015-2419 (T1204.001)
• CVE-2016-0189 (T1204.001)
• CVE-2016-4117 (T1203)
• CVE-2017-0143 (T1204.001)
• CVE-2025-34026 (T1204.001)
• CVE-2015-0097 (T1204.001)
• CVE-2017-8570 (T1204.001)
• CVE-2017-12149 (T1204.001)
• CVE-2015-2424 (T1204.001)
• CVE-2015-1641 (T1204.001)
• CVE-2025-55182 (T1204.001)
• CVE-2011-3544 (T1204.001)
• CVE-2017-17215 (T1204.001)
• CVE-2013-2465 (T1204.001)
• CVE-2012-1723 (T1204.001)
• CVE-2014-4148 (T1204.001)
• CVE-2011-3402 (T1204.001)
• CVE-2015-2426 (T1204.001)
• CVE-2015-4902 (T1204.001)
• CVE-2014-3897 (T1204.001)
• CVE-2010-2572 (T1204.001)
• CVE-2025-55184 (T1204.001)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る