APT33

APT33, an Iran-linked threat actor also known as Peach Sandstorm, Holmium, Elfin, Refined Kitten, and Magic Hound, has been involved in a series of cyber espionage activities targeting various sectors. The group's primary targets include the government, defense, satellite, oil, and gas sectors in the U.S. and UAE. APT33 has developed and deployed a new custom multi-stage backdoor malware named Tickler to compromise these organizations, demonstrating the group's evolving capabilities and persistent threat. In a recent campaign, APT33 utilized the FalseFont backdoor to target the Defense Industrial Base sector. Microsoft researchers have observed the group creating Azure tenants using Microsoft Outlook email accounts and setting up Azure for Students subscriptions within these tenants. This new strategy underlines the sophisticated tactics employed by APT33 and its continuous efforts to infiltrate high-value targets globally. Starting from February 2023, APT33 launched an extensive password spray attack campaign that affected thousands of organizations worldwide, including those in the defense sector. Microsoft issued a warning in September about this coordinated effort by APT33. To mitigate the risks associated with these attacks, network defenders are advised to reset credentials for targeted accounts, thereby reducing the attack surface exploited by APT33 hackers.