Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.

This Symantec report profiles Elfin (APT33), an active espionage group that has targeted ~50 organizations (notably in Saudi Arabia and the U.S.) since 2016, describing their reconnaissance and website-scanning approach, exploitation of a WinRAR vulnerability, use of custom and commodity malware (POSHC2, Quasar, DarkComet, AutoIt tools), a detailed case study of intrusion and exfiltration, and a comprehensive set of IoCs and recommended protections.