H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[StoneDrill](https://attack.mitre.org/software/S0380) is wiper malware discovered in destructive campaigns against both Middle Eastern and European targets in association with [APT33](https://attack.mitre.org/groups/G0064).(Citation: FireEye APT33 Sept 2017)(Citation: Kaspersky StoneDrill 2017)

Labels

malware

16 recorded

Relationships

uses

from APT33

Group

uses

to Data Destruction

Technique

uses

to Disk Content Wipe

Technique

uses

to Disk Structure Wipe

Technique

uses

to Encrypted/Encoded File

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Process Injection

Technique

uses

to Query Registry

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to System Information Discovery

Technique

uses

to System Time Discovery

Technique

uses

to Virtualization/Sandbox Evasion

Technique

uses

to Visual Basic

Technique

uses

to Windows Management Instrumentation

Technique

5 external

References

mitre-attack

S0380

DROPSHOT

—

StoneDrill

—

Kaspersky StoneDrill 2017

https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180722/Report_Shamoon_StoneDrill_final.pdf

FireEye APT33 Sept 2017

https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html