HOLMIUM

Holmium, also known as Curious Serpens, Peach Sandstorm, APT33, Elfin, MAGNALIUM, or REFINED KITTEN, is a threat actor that has been active since 2013. This group is responsible for executing malicious activities with the intent of breaching security and conducting cyber espionage. The group is linked to Iran and has been observed targeting thousands of organizations worldwide. Multiple reports suggest that Holmium's activities are multifaceted, involving various methods such as password spraying and the use of custom multi-stage backdoor malware. Since February 2023, Microsoft has reported several instances of password spraying activity against numerous organizations by this threat actor. In addition, the group has conducted a series of attacks using newly discovered FalseFont backdoor malware, specifically targeting organizations in the Defense Industrial Base (DIB) sector. The group has leveraged novel malware in their attacks, demonstrating their ability to adapt and evolve their techniques to bypass security measures. The threat posed by Holmium extends beyond mere password spraying. The group has been observed deploying new custom multi-stage backdoor malware named Tickler to compromise organizations in sectors such as government, defense, satellite, oil, and gas in the U.S. and UAE. In early November, Microsoft’s Threat Intelligence team reported that Holmium attempted to deliver the new FalseFont malware. This ongoing activity underscores the persistent and evolving nature of the threat posed by Holmium to global cybersecurity.