Loading malware…
TurnedUp is a custom Windows backdoor associated with the Iran-linked threat group APT33, also tracked by some vendors as Magnallium, Holmium, Elfin Team, Refined Kitten, and Peach Sandstorm. It has been used in espionage operations targeting aerospace, aviation, petrochemical, energy, and other critical infrastructure-related organizations, particularly in the United States, Saudi Arabia, and South Korea. Reporting places APT33 activity as early as 2013 and links TurnedUp to broader Iranian state-aligned cyber operations.
TurnedUp supports interactive post-compromise control and host surveillance. Documented capabilities include collecting system information, uploading and downloading files, creating a reverse shell, taking screenshots, and establishing persistence through Windows Registry Run keys. It has also been observed in conjunction with process injection tradecraft, including use of the Early Bird APC injection technique to execute code in newly created suspended processes before normal thread startup, a method intended to evade some user-mode security hooks.
APT33 has reportedly delivered TurnedUp through the DropShot dropper, which could alternatively deploy the ShapeShift wiper, indicating operational overlap between espionage access and potentially destructive tooling. The group is known for spearphishing campaigns using recruitment-themed lures and malicious HTA attachments, as well as spoofed aviation- and defense-related branding to target victims. TurnedUp has been described as part of long-dwell intrusions involving reconnaissance, persistence, and lateral movement against sensitive systems in critical infrastructure environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Key TTPs: Reconnaissance and surveillance of critical infrastructure; deployment of custom malware (DROPSHIP, TURNEDUP) for persistence; lateral movement targeting sensitive systems; dwell times averaging 6+ months for intelligence collection.
MAGNALLIUM ... CAPABILITIES: STONEDRILL wiper, variants of TURNEDUP malware
8 distinct techniques documented for this family, organized by ATT&CK tactic.
Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Custom malware used by APT33 for persistence in long-term cyber espionage campaigns.
Malware that establishes persistence by writing to a Registry Run key.
Backdoor malware capable of taking screenshots.
Backdoor malware capable of persisting via a Registry Run key.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.