Peach Sandstorm

Peach Sandstorm, also known as Curious Serpens, APT33, Elfin, HOLMIUM, MAGNALIUM, and Refined Kitten, is a threat actor that has been active since 2013. This Iran-linked cyberespionage group has targeted various sectors, including aerospace, energy, government, defense, satellite, oil, and gas. It has shown consistent interest in U.S. and other countries' organizations, particularly in the satellite, defense, and to some extent, pharmaceutical sectors. In 2023, Peach Sandstorm carried out a series of password spray attacks attempting to authenticate to thousands of environments. In 2024, Microsoft observed Peach Sandstorm developing and deploying a new backdoor named FalseFont to target individuals working for organizations in the Defense Industrial Base (DIB) sector. The use of FalseFont aligns with Peach Sandstorm's activities over the past year, indicating an ongoing improvement in their tradecraft. Between April and July 2024, Peach Sandstorm also deployed a custom multi-stage backdoor, Tickler, leveraging Azure infrastructure hosted in fraudulent, attacker-controlled Azure subscriptions for command-and-control (C2). Peach Sandstorm's activities have included lateral movement via SMB and compromising user accounts as part of broader password spray operations. In May 2024, the group compromised a user account with minimal access permissions at a county-level government in a swing state. Microsoft's reports suggest that Peach Sandstorm continues to pose a significant threat to high-value targets, particularly those within the DIB sector, demonstrating both a willingness and capability to develop and deploy sophisticated malware tools for espionage purposes.