Microsoft has published information on a highly concerning malware campaign being carried out by suspected Iranian state-backed threat group, Peach Sandstorm.
Between April and July 2024, Microsoft’s threat intelligence arm observed the collective deploying a newly developed custom multi-stage backdoor, which it has dubbed Tickler.
The malware has been used to target businesses operating in the satellite, communications equipment, oil and gas, and government sectors in the US and UAE.
Microsoft analyzed two samples of the malware that were deployed in compromised environments as recently as July 2024. The first of which was found in an archive file named Network Security.zip hidden amongst numerous benign PDF files.
The malware collects network information from the host environment and passes it back to the attacker's C2 URI via a HTTP POST request, which Microsoft speculated was to help the attacker orient themselves on the network.
Microsoft observed the group iterating and improving on the initial malware sample, with a second iteration, sold.dll, described as a Trojan dropper.
Functionally identical to the original version, the second sample downloads additional paloads from the C2 server, including a backdoor, a batch script to ensure the backdoor is persistent on the network.
The malware also downloads a series of legitimate files, likely used for DLL sideloading purposes, according to the report.
Microsoft added that the group had leveraged Azure infrastructure in fraudulent, attacker-controlled Azure subscriptions for command-and-control. This included creating Azure tenants using Outlook email accounts and generating Azure for Student subscriptions using these tenants.
The report noted other Iranian hacking groups, including Smoke Sandstorm, had been observed using similar techniques in recent months.
Peach Sandstorm continues password spraying campaign to gain initial access
Microsoft has tracked Peach Sandstorm’s activity intently in recent years, noting the organization has demonstrated an interest in organizations in the defense, communications, and healthcare industries.
The group’s previous campaigns relied on password spraying attacks as an initial access vector, employing the technique since at least February 2023 according to the report.
The latest update from Microsoft stated the operation has continued to leverage this technique against organizations in the educational sector for “infrastructure procurement”, as well as the satellite, government, and defense sector for intelligence collection – the group’s primary objective.
Peach Sandstorm has also been observed deploying social engineering attacks in order to gain initial access.
Going back to at least November 2021, Microsoft tracked the group using multiple fake LinkedIn profiles, purporting to be students, developers and talent acquisition managers based in the US and Western Europe.
“Peach Sandstorm primarily used them to conduct intelligence gathering and possible social engineering against the higher education, satellite sectors, and related industries,” the report added.
Microsoft said the identified LinkedIn accounts were reported to the social network and were subsequently removed from the platform.
Once Peach Sandstorm gains access to an organization’s environment, the group is known to perform lateral movement techniques.
For example, Microsoft referred to a recent incident where, after compromising a European defense organization, the group moved laterally via the server message block (SMB) protocol. SMB is described as a lateral movement technique used to move between compromised devices on a network.
