Apt33 Elfin
Adversary-emulation profile for APT33 (Elfin, Peach Sandstorm, HOLMIUM), a suspected...
Install
npx skills add BitterSecurity/Decepticon --skill apt33-elfin -g -a claude-code -y- Repository
- BitterSecurity/Decepticon6.5k
- Category
- Engineering
- Updated
- 3d ago
- License
- Apache-2.0
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Adversary-emulation profile for APT33 (Elfin, Peach Sandstorm, HOLMIUM), a suspected Iranian state-sponsored espionage group, mapped to MITRE ATT&CK G0064 with Decepticon emulation guidance.
APT33 (Elfin, Peach Sandstorm, HOLMIUM), Adversary Emulation Profile
APT33 (MITRE ATT&CK G0064; aliases Elfin, Peach Sandstorm, HOLMIUM) is a suspected Iranian state-sponsored threat group that has conducted cyber-espionage operations since at least 2013. The group is best known for spearphishing-driven intrusions against the aviation, energy, and petrochemical sectors in the United States, Saudi Arabia, and South Korea, and for an enduring evolution from .hta-based phishing toward large-scale cloud-identity attacks. Its operations blend publicly available offensive tooling with custom backdoors, and the group has been linked, with varying confidence, to destructive wiper malware. This profile maps APT33's documented TTPs to ATT&CK and provides emulation guidance for Decepticon under authorized engagement scope.
