Falsefont

FalseFont is a new type of malware developed and used by the Iranian nation-state actor Peach Sandstorm, as observed by Microsoft. The custom backdoor malware, unveiled by Microsoft, provides its operators remote access to compromised systems, allowing for file execution and transfer to its command-and-control (C2) servers. This development aligns with Peach Sandstorm's activities over the past year, indicating that the group is continuously improving their tradecraft. The primary target of FalseFont has been the Defense Industrial Base (DIB) sector. Specifically, APT33, an Iran-linked group, has been using this backdoor malware to target defense contractors worldwide. The campaign has seen the delivery of FalseFont to individuals working within organizations in the DIB sector, showing a focused and strategic approach in their attacks. Microsoft's security intelligence team has been monitoring the situation closely and has released information about the threat to raise awareness and prompt action among potential targets. As the cyber-espionage activities of groups like APT33 continue to evolve, it is crucial for organizations in sensitive sectors like the DIB to stay vigilant, maintain robust cybersecurity measures, and respond swiftly to emerging threats such as FalseFont.