Refined Kitten

Refined Kitten, also known as APT33, Peach Sandstorm, Elfin, HOLMIUM, and MAGNALIUM, is a threat actor that has been active since at least 2013. This group is linked to Iran and specializes in cyberespionage, targeting sectors such as government, defense, satellite, oil, and gas primarily in the U.S. and UAE. Microsoft researchers reported that this group used a new custom multi-stage backdoor called Tickler to compromise organizations within these sectors. The group has demonstrated its ability to deploy sophisticated attacks, including password spraying campaigns that have affected thousands of targets. Between February and July, the Iranian government hacker group carried out a wave of password spraying attacks against thousands of targets. Microsoft previously tracked the group under the name Holmium but has since identified it as Peach Sandstorm or Refined Kitten. In addition to these attacks, the group was observed attempting to breach defense contractors using a new malware known as FalseFont. These breaches targeted defense organizations worldwide, demonstrating the group's extensive reach and persistent threat to global security. Despite the serious nature of their actions, these threat actors often operate under aliases like Fancy Bear and Refined Kitten, which can potentially undermine the perception of their activities' severity. However, their efforts have significant implications for the sectors they target, particularly those related to research and development of military weapons, systems, subsystems, and components. As a result, ongoing monitoring and proactive defensive measures are crucial in mitigating the risks posed by these threat actors.