Peach Sandstorm

Peach Sandstorm, also known as Curious Serpens, APT33, Elfin, HOLMIUM, MAGNALIUM, or REFINED KITTEN, is a threat actor linked to the Iranian Islamic Revolutionary Guard Corps (IRGC). Active since at least 2013, this espionage group has primarily targeted aerospace and energy sectors, alongside government agencies, particularly in the United States and the United Arab Emirates. Microsoft has observed Peach Sandstorm's persistent efforts to deliver a newly developed backdoor named FalseFont to individuals working for organizations in the Defense Industrial Base (DIB) sector, demonstrating its ongoing interest in organizations within satellite, defense, and pharmaceutical sectors. Throughout 2023 and 2024, Peach Sandstorm has shown consistent advancements in its tradecraft. In addition to FalseFont, the group has deployed a new custom multi-stage backdoor, Tickler, which was used for long-running intelligence gathering operations. The group leveraged Azure infrastructure hosted in fraudulent, attacker-controlled Azure subscriptions for command-and-control (C2). Notably, between February and July 2023, Peach Sandstorm carried out a wave of password spray attacks, attempting to authenticate to thousands of environments, further indicating their intent to improve their tactics, techniques, and procedures (TTPs). In specific incidents, Peach Sandstorm compromised a user account "with minimal access permissions at a county-level government in a swing state" as part of a broader password spray operation in May. Between April and July 2024, the group was observed performing lateral movement via SMB and targeting sectors such as government, defense, satellite, oil, and gas in the U.S. and UAE using the Tickler backdoor. These activities underscore Peach Sandstorm's persistent threat to global security and the need for robust cybersecurity measures against such advanced persistent threats.