APT33: The Aerospace Stalker — Iran's IRGC-Linked Cyber Espionage Group Targeting Defence and Energy

A decade of targeting aerospace and energy.

APT33 — also tracked as Elfin, Peach Sandstorm, Refined Kitten, Magnallium, HOLMIUM, and Cobalt Trinity — is an Iranian state-sponsored cyber espionage group that has been conducting operations since at least 2013. First publicly documented by FireEye (now Mandiant) in 2017, the group is assessed with high confidence to operate on behalf of the Islamic Revolutionary Guard Corps (IRGC), with activities aligned to Iran's strategic military and economic objectives.

APT33's targeting is distinctive and consistent: aerospace, defence, energy, and petrochemical organisations — the sectors that hold the technology, intellectual property, and strategic intelligence that Iran needs but cannot acquire through legitimate channels due to international sanctions. They have compromised US aerospace firms, Saudi petrochemical conglomerates, South Korean oil refineries, European defence contractors, and satellite operators. Every target selection maps directly to Iranian national interests.

What makes APT33 particularly significant in the current threat landscape is their evolution. The group that relied on basic spear-phishing and commodity malware in 2016 is not the same group operating today. By 2024, APT33 had developed custom backdoors like Tickler and FalseFont, adopted cloud-based command and control infrastructure on Azure, launched password spray campaigns targeting thousands of organisations simultaneously, and demonstrated sophisticated cloud-based TTPs that Microsoft described as "materially more sophisticated" than their earlier capabilities. They are getting better, and they are getting faster.

Connecting APT33 to the Iranian state.

Attribution of APT33 to Iran rests on multiple independent lines of evidence. FireEye's original 2017 analysis identified Farsi (Persian) language artefacts in the group's custom malware, operational activity patterns aligning with Iran Standard Time business hours, and inactivity during the Iranian weekend (Thursday afternoon and Friday). More directly, a hacker using the pseudonym xman_1365_x was linked both to APT33's TurnedUp backdoor source code and to the Iranian Nasr Institute — an organisation previously connected to the Iranian Cyber Army.

Sectors that build what Iran cannot.

APT33's target selection is not opportunistic. It directly reflects Iran's strategic requirements: the aerospace and missile technology that sanctions prevent Iran from acquiring, the defence intelligence that informs Iran's military planning, the energy sector knowledge that underpins Iran's economic survival, and the satellite capabilities that support both military and civilian objectives.

From spear-phishing to cloud-native operations.

APT33's operational history demonstrates a clear trajectory of increasing sophistication. Understanding this evolution is important because it indicates where the group is heading next — and the defences that were adequate against their 2017 capabilities are not adequate against their 2024 tradecraft.

How they get in.

APT33 uses two primary initial access methods, and their balance has shifted over time. Early campaigns relied heavily on spear-phishing. Recent campaigns increasingly use password spraying — a technique that scales massively and exploits weak or reused passwords across thousands of organisations simultaneously.

Custom malware and commodity tools.

APT33 maintains a broad arsenal spanning custom-developed malware, open-source offensive tools, and legitimate system utilities. Their tooling strategy has evolved: early operations relied on custom backdoors, middle-period campaigns shifted to commodity RATs for deniability, and recent operations have returned to custom malware (Tickler, FalseFont) while leveraging cloud infrastructure — indicating renewed investment in capability development.

How APT33 weaponised Azure infrastructure.

APT33's 2023–2024 campaigns reveal a significant operational shift: the group now leverages cloud infrastructure — specifically Microsoft Azure — both as a target and as a tool. This cloud-native approach provides several advantages that align with sophisticated espionage operations.

Espionage with destructive potential.

APT33 occupies an unusual position among espionage groups: they maintain destructive capabilities. The SHAPESHIFT wiper, delivered by APT33's exclusive DROPSHOT dropper, shares code similarities with the Shamoon wiper malware used in devastating attacks against Saudi Aramco (2012, destroying 35,000 workstations), Saudi government agencies (2016–2017), and Italian oil company Saipem (2018).

FireEye and other researchers have noted that while APT33 has not been directly observed deploying SHAPESHIFT for destructive purposes, the capability exists within their toolkit. This creates an unsettling dual-threat: the same access that enables espionage — persistent presence within aerospace, defence, and energy networks — could be repurposed for destructive attacks if Iran's strategic calculus changes. A group that has spent months mapping a petrochemical company's network for intelligence collection could, with a single command change, deploy a wiper instead.

For defenders in the energy and critical infrastructure sectors, this dual-threat nature means that APT33 compromise indicators warrant immediate, high-priority response — not just because of the espionage risk, but because of the latent destructive potential that every APT33 foothold represents.

Techniques across the kill chain.

Finding APT33 in your environment.

APT33's shift to password spraying as a primary initial access technique means that the first detectable signal is often an authentication anomaly — not a malware detection. Organisations that rely solely on endpoint detection will miss the initial compromise entirely. Detection must span identity, cloud, network, and endpoint telemetry.

Hardening against APT33's current tradecraft.

The bottom line.

APT33 is Iran's aerospace and defence specialist — a persistent, evolving threat group that has been stealing intellectual property and strategic intelligence from organisations in these sectors for over a decade. Their operations directly support Iran's military ambitions, compensating for the technology gap that international sanctions create.

The group's evolution from basic spear-phishing to cloud-native operations — password spraying thousands of organisations, leveraging Azure infrastructure for C2, deploying custom malware like Tickler and FalseFont, and conducting Golden SAML attacks — demonstrates a trajectory of increasing capability. Organisations that defended successfully against APT33's 2017 tactics may be unprepared for their 2024 tradecraft.

For organisations in the aerospace, defence, energy, satellite, or military supply chain: APT33 is a specific, documented, and active threat to your intellectual property and strategic data. Their TTPs are catalogued. Their targeting patterns are predictable. Defending against them requires MFA as a baseline, cloud monitoring as a necessity, and threat-informed hunting as an ongoing discipline. The group that stole aerospace technology in 2017 is still operating today — and they are better at it than they have ever been.