THREAT ACTOR PROFILE
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg"><path d="M 60.26 161.592 C 45.127 161.592 33.328 160.872 24.861 159.431 C 16.394 157.809 10.358 156.188 6.756 154.567 C 3.153 152.765 0.901 151.504 0 150.784 L 13.511 121.6 C 17.114 121.96 22.428 122.41 29.454 122.951 C 36.48 123.311 46.118 123.671 58.368 124.032 C 70.618 124.392 86.291 124.572 105.387 124.572 C 113.313 124.572 118.358 123.221 120.519 120.519 C 122.681 117.636 123.762 114.484 123.762 111.061 L 123.762 109.98 C 123.762 105.837 122.681 102.504 120.519 99.982 C 118.358 97.46 114.124 96.199 107.819 96.199 L 34.318 96.199 L 34.318 64.042 L 99.712 64.042 C 104.576 64.042 108.359 63.232 111.062 61.61 C 113.944 59.989 115.385 56.836 115.385 52.152 L 115.385 49.18 C 115.385 45.397 114.574 42.514 112.953 40.533 C 111.332 38.371 107.909 37.29 102.685 37.29 L 92.146 37.29 C 80.617 37.29 69.537 37.56 58.909 38.101 C 48.28 38.641 38.912 39.362 30.806 40.263 C 22.879 40.983 16.754 41.794 12.43 42.695 L 9.728 8.106 C 10.989 7.746 15.493 6.935 23.239 5.674 C 31.166 4.233 41.705 2.972 54.855 1.891 C 68.006 0.63 83.139 0 100.253 0 L 107.549 0 C 122.681 0 134.571 1.801 143.218 5.404 C 152.045 8.827 158.35 13.691 162.134 19.996 C 165.917 26.301 167.808 33.777 167.808 42.424 L 167.808 47.018 C 167.808 52.423 166.817 57.016 164.836 60.8 C 162.854 64.402 160.602 67.195 158.08 69.176 C 155.558 71.158 153.396 72.509 151.595 73.23 C 167.988 78.094 176.185 90.164 176.185 109.44 L 176.185 113.223 C 176.185 128.175 171.591 139.975 162.404 148.622 C 153.396 157.269 137.904 161.592 115.926 161.592 Z M 250.682 161.592 C 235.55 161.592 223.75 160.872 215.283 159.431 C 206.816 157.809 200.781 156.188 197.178 154.567 C 193.575 152.765 191.323 151.504 190.422 150.784 L 203.934 121.6 C 207.537 121.96 212.851 122.41 219.877 122.951 C 226.902 123.311 236.54 123.671 248.79 124.032 C 261.041 124.392 276.713 124.572 295.809 124.572 C 303.736 124.572 308.78 123.221 310.942 120.519 C 313.103 117.636 314.184 114.484 314.184 111.061 L 314.184 109.98 C 314.184 105.837 313.103 102.504 310.942 99.982 C 308.78 97.46 304.546 96.199 298.241 96.199 L 224.741 96.199 L 224.741 64.042 L 290.134 64.042 C 294.998 64.042 298.782 63.232 301.484 61.61 C 304.366 59.989 305.807 56.836 305.807 52.152 L 305.807 49.18 C 305.807 45.397 304.997 42.514 303.375 40.533 C 301.754 38.371 298.331 37.29 293.107 37.29 L 282.568 37.29 C 271.039 37.29 259.96 37.56 249.331 38.101 C 238.702 38.641 229.334 39.362 221.228 40.263 C 213.301 40.983 207.176 41.794 202.853 42.695 L 200.15 8.106 C 201.411 7.746 205.915 6.935 213.662 5.674 C 221.588 4.233 232.127 2.972 245.278 1.891 C 258.428 0.63 273.561 0 290.675 0 L 297.971 0 C 313.103 0 324.993 1.801 333.64 5.404 C 342.467 8.827 348.773 13.691 352.556 19.996 C 356.339 26.301 358.23 33.777 358.23 42.424 L 358.23 47.018 C 358.23 52.423 357.24 57.016 355.258 60.8 C 353.276 64.402 351.025 67.195 348.502 69.176 C 345.98 71.158 343.819 72.509 342.017 73.23 C 358.411 78.094 366.607 90.164 366.607 109.44 L 366.607 113.223 C 366.607 128.175 362.014 139.975 352.826 148.622 C 343.819 157.269 328.326 161.592 306.348 161.592 Z" fill="rgb(37, 101, 195)" height="161.592px" id="Q3XhAan57" transform="translate(70.99 239.838)" width="366.6067987060547px"/><path d="M 0 58.639 L 29.17 0.1 L 48.783 0.1 L 77.853 58.639 L 62.521 58.639 L 56.647 45.995 L 21.007 45.995 L 14.535 58.639 Z M 24.591 36.239 L 52.964 36.239 L 39.325 9.06 L 38.329 9.06 Z M 83.102 58.639 L 83.102 8.064 L 82.106 0 L 126.21 0 C 130.457 0 133.776 0.564 136.165 1.693 C 138.621 2.821 140.413 4.314 141.541 6.173 C 142.736 7.965 143.499 9.889 143.831 11.947 C 144.163 14.004 144.329 15.962 144.329 17.821 L 144.329 23.695 C 144.329 25.221 144.096 26.947 143.632 28.871 C 143.167 30.73 142.304 32.555 141.043 34.347 C 139.782 36.073 137.957 37.533 135.568 38.727 C 133.178 39.856 130.059 40.42 126.21 40.42 L 116.055 40.42 C 111.874 40.42 107.958 40.32 104.307 40.121 C 100.723 39.922 98.035 39.756 96.243 39.623 L 96.243 58.639 Z M 96.243 30.863 L 123.322 30.863 C 126.309 30.863 128.367 30.132 129.495 28.672 C 130.623 27.212 131.187 25.453 131.187 23.396 L 131.187 17.124 C 131.187 15 130.623 13.208 129.495 11.748 C 128.367 10.288 126.342 9.558 123.422 9.558 L 96.243 9.558 Z M 174.509 58.639 L 174.409 9.558 L 148.525 9.558 L 148.525 0 L 213.634 0 L 213.634 9.558 L 187.65 9.558 L 187.65 58.639 Z" fill="rgb(37, 101, 195)" height="58.63900000149012px" id="ksN1cAN_Q" transform="translate(139.861 112.653)" width="213.63399389648436px"/></svg>)
APT33 is an Iranian state-sponsored group active since at least 2013, known for destructive attacks and long-running espionage against aviation, energy, defense and government targets. It is tied to the Shamoon disk wiper and, in recent activity tracked as Peach Sandstorm, to custom backdoors like FalseFont and Tickler delivered through elaborate social engineering.
Country:
Iran
Aviation / Energy / Defense
First seen
2013
Latest IOC
-
TABLE OF CONTENTS
NAMES AND ALIASES
-
-
-
GROUP PROFILE
Facts:
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Victims reported in our records and posts:
-
-
-
-
-
-
ATTACK LIFECYCLE
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
MALWARE AND TOOLING
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
CVES EXPLOITED
CVE-2026-21509
A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.
CVE-2026-21509
A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.
Latest IOCs
We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.
NOTABLE CAMPAIGNS
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.