Crimson Sandstorm

Crimson Sandstorm, an Advanced Persistent Threat (APT) group linked to Iran, has been identified as a significant threat actor in the cybersecurity landscape. This entity, potentially connected to the Islamic Revolutionary Guard Corps and active since at least 2017, targets victims across diverse sectors including defense, maritime shipping, transportation, healthcare, and technology. Crimson Sandstorm, also known as CURIUM, has utilized AI services to generate phishing emails, code snippets, and develop code to evade detection mechanisms. The group has been notably using Microsoft's AI services, leveraging OpenAI’s ChatGPT, which forms the basis for Microsoft’s Copilot. The group's malicious activities include deploying new IMAPLoader malware attacks and launching watering hole attacks. These tactics facilitate the distribution of the IMAPLoader malware and are part of a broader Iranian state-sponsored advanced persistent threat operation, which includes other aliases such as Tortoiseshell, TA456, Imperial Kitten, and Yellow Liderc. Crimson Sandstorm has been using AI to support scripting related to app and web development, generate content likely for spear-phishing campaigns, and research common ways for malware to evade detection. In response to these threats, OpenAI has partnered with Microsoft Threat Intelligence to counteract state-backed hacking organizations, including Crimson Sandstorm. As part of their efforts, they have disrupted hacking attempts from five state-affiliated malicious actors, including Charcoal Typhoon and Salmon Typhoon (China), Crimson Sandstorm (Iran), Emerald Sleet (North Korea), and Forest Blizzard (Russia). Despite the sophisticated use of AI by these groups, no substantial advances in evasion techniques or supercharged coding have been observed yet.