# Apt33 Elfin

Adversary-emulation profile for APT33 (Elfin, Peach Sandstorm, HOLMIUM), a suspected...

- Repository: https://github.com/BitterSecurity/Decepticon (6507 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add BitterSecurity/Decepticon --skill apt33-elfin -g -a claude-code -y`
Codex: `npx skills add BitterSecurity/Decepticon --skill apt33-elfin -g -a codex -y`
Cursor: `npx skills add BitterSecurity/Decepticon --skill apt33-elfin -g -a cursor -y`
Gemini CLI: `npx skills add BitterSecurity/Decepticon --skill apt33-elfin -g -a gemini-cli -y`

## Description

Adversary-emulation profile for APT33 (Elfin, Peach Sandstorm, HOLMIUM), a suspected Iranian state-sponsored espionage group, mapped to MITRE ATT&CK G0064 with Decepticon emulation guidance.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# APT33 (Elfin, Peach Sandstorm, HOLMIUM), Adversary Emulation Profile

APT33 (MITRE ATT&CK **G0064**; aliases Elfin, Peach Sandstorm, HOLMIUM) is a suspected Iranian state-sponsored threat group that has conducted cyber-espionage operations since at least 2013. The group is best known for spearphishing-driven intrusions against the aviation, energy, and petrochemical sectors in the United States, Saudi Arabia, and South Korea, and for an enduring evolution from `.hta`-based phishing toward large-scale cloud-identity attacks. Its operations blend publicly available offensive tooling with custom backdoors, and the group has been linked, with varying confidence, to destructive wiper malware. This profile maps APT33's documented TTPs to ATT&CK and provides emulation guidance for Decepticon under authorized engagement scope.

## Attribution & motivation

The rest: https://github.com/BitterSecurity/Decepticon/blob/HEAD/packages/decepticon/decepticon/skills/shared/adversary-emulation/apt33-elfin/SKILL.md