Английская Википедия:Elfin Team

Материал из Онлайн справочника
Перейти к навигацииПерейти к поиску

Шаблон:Short description Advanced Persistent Threat 33 (APT33) is a hacker group identified by FireEye as being supported by the government of Iran.[1][2] The group has also been called Elfin Team, Refined Kitten (by Crowdstrike), Magnallium (by Dragos), Peach Sandstorm,[3] and Holmium (by Microsoft).[4][5][6]

History

FireEye believes that the group was formed no later than 2013.[1]

Targets

APT33 has reportedly targeted aerospace, defense and petrochemical industry targets in the United States, South Korea, and Saudi Arabia.[1][2]

Modus operandi

APT33 reportedly uses a dropper program designated DropShot, which can deploy a wiper called ShapeShift, or install a backdoor called TurnedUp.[1] The group is reported to use the ALFASHELL tool to send spear-phishing emails loaded with malicious HTML Application files to its targets.[1][2]

APT33 registered domains impersonating many commercial entities, including Boeing, Alsalam Aircraft Company, Northrop Grumman and Vinnell.[2]

Identification

FireEye and Kaspersky Lab noted similarities between the ShapeShift and Shamoon, another virus linked to Iran.[1] APT33 also used Farsi in ShapeShift and DropShot, and was most active during Iran Standard Time business hours, remaining inactive on the Iranian weekend.[1][2]

One hacker known by the pseudonym of xman_1365_x was linked to both the TurnedUp tool code and the Iranian Nasr Institute, which has been connected to the Iranian Cyber Army.[7][1][2][8] xman_1365_x has accounts on Iranian hacker forums, including Shabgard and Ashiyane.[7]

See also

References

Шаблон:Reflist

Шаблон:Hacking in the 2010s