Who is APT 33, Elfin, Magnallium?

APT 33, Elfin, Magnallium is a threat actor attributed to IR, also known as APT 33, Elfin, Magnallium. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does APT 33, Elfin, Magnallium exploit?

APT 33, Elfin, Magnallium is known to exploit 1 CVEs. View the full list on the Strobes VI threat actor profile page.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

APT 33, Elfin, Magnallium

Also known as: APT 33, Elfin, Magnallium, Holmium, ATK 35, Refined Kitten, TA451, Cobalt Trinity, Peach Sandstorm, Yellow Orc, Curious Serpens, G0064, MAGNALLIUM, HOLMIUM, COBALT TRINITY, ATK35

IRInformation theft and espionage , Sabotage and destruction

Exploited CVEs

Overview

When discussing suspected Middle Eastern hacker groups with destructive capabilities, many automatically think of the suspected Iranian group that previously used SHAMOON – aka Disttrack – to target organizations in the Persian Gulf. However, over the past few years, we have been tracking a separate, less widely known suspected Iranian group with potential destructive capabilities, whom we call APT33. Our analysis reveals that APT33 is a capable group that has carried out cyber espionage operations since at least 2013. We assess APT33 works at the behest of the Iranian government. APT33 has targeted organizations – spanning multiple industries – headquartered in the United States, Saudi Arabia and South Korea. APT33 has shown particular interest in organizations in the aviation sector involved in both military and commercial capacities, as well as organizations in the energy sector with ties to petrochemical production. APT 33 seems to be closely related to OilRig, APT 34, Helix Kitten, Chrysene since at least 2017.

Exploited Vulnerabilities

CVE ID	Action