APT33

APT33, also known as Peach Sandstorm, is an Iran-linked threat actor associated with the Iranian Islamic Revolutionary Guard Corps (IRGC). This group has targeted communication equipment, government agencies, and the oil-and-gas industry in the United Arab Emirates and the United States, primarily for intelligence gathering. One of their recent activities includes targeting the Defense Industrial Base sector using a backdoor called FalseFont. Since July 2024, APT33 has been deploying a new custom multi-stage backdoor malware, 'Tickler', to compromise organizations in sectors such as government, defense, satellite, oil, and gas in the U.S. and UAE. Microsoft observed APT33 creating Azure tenants using Microsoft Outlook email accounts and setting up Azure for Students subscriptions within these tenants, indicating a sophisticated level of infiltration and manipulation of widely used software services. In September, Microsoft issued a warning about another campaign coordinated by APT33 that targeted thousands of organizations worldwide, including those in the defense sector, in extensive password spray attacks since February 2023. To mitigate the risk posed by APT33's activities, network defenders are advised to reset credentials for accounts targeted in password spray attacks, thereby reducing the attack surface exploited by APT33 hackers.