Microsoft has noticed the Iranian nation-state cyberattackers often called Peach Sandstorm making an attempt to ship a backdoor to people working for organizations within the military-industrial sector.
In a sequence of messages on X, previously Twitter, Microsoft Risk Intelligence mentioned the Peach Sandstorm superior persistent menace (aka APT33, Elfin, Holmium, or Refined Kitten) has been making an attempt to ship the FalseFont backdoor to numerous organizations throughout the world infrastructure that allows the analysis and improvement of army weapons, methods, subsystems, and elements.
Microsoft Risk Intelligence says FalseFont is a customized backdoor with a “wide selection of functionalities” that permit operators to remotely entry an contaminated system, launch extra recordsdata, and ship info to its command and management servers.
FalseFont was first noticed getting used towards targets in early November. It was not clear if there have been any detections of profitable infections.
Microsoft mentioned Peach Sandstorm has persistently demonstrated curiosity in organizations within the satellite tv for pc and protection sectors in 2023. The event and use of FalseFont is in keeping with Peach Sandstorm exercise noticed by Microsoft over the previous 12 months, suggesting the group is continuous to enhance their tradecraft.
