Microsoft: Hackers Linked to the Islamic Republic Targeted Defense Companies with 'New Malware'

According to a report by Microsoft's Threat Intelligence team, an Iranian cyber espionage group has targeted thousands of defense companies using recently discovered malware. A group associated with the Islamic Republic, known as 'Pich Sandstorm', is recognized for probing organizations in the aerospace and pharmaceutical sectors. Research reports indicate that the hackers attempted to deliver a new 'backdoor' malware named 'False Front' to users working in the defense industries. This sector includes over 100,000 defense companies and subcontractors involved in the research, development, and production of military weapon systems, subsystems, and components. If False Front is installed, hackers can remotely access the user's system, launch additional files, and send sensitive information to their command and control servers. Microsoft states that the development and use of False Front aligns with the activities of 'Pich Sandstorm', which was identified by the company last year, and these hackers continue to enhance their capabilities. Microsoft experts recently identified this new malware used by Iranian hackers. Microsoft has provided methods to mitigate potential False Front attacks, including resetting account passwords for those targeted by 'password spray' attacks. Additionally, network defenders are advised to revoke session cookies and other multi-factor authentication settings altered by the attacker in compromised accounts. To enhance account security against password spray or 'brute force' attacks, users are also encouraged to consider a passwordless primary authentication method. According to Microsoft, these recommendations are crucial for protecting privileged administrator accounts on workstations. This cyber group, also known as 'Holmium', 'Refined Kitten', or 'APT33', has targeted organizations in the United States, Saudi Arabia, and South Korea. The group's cyber espionage operations date back at least to 2013. In September, Microsoft announced that this group linked to the Islamic Republic had conducted a wave of password spray attacks. Password spraying is an attempt to use a common password to access multiple accounts and prevent account lockout, which typically occurs when passwords are used in a single account. The company stated that during successful attacks, information from a limited number of victims in the defense, satellite, and pharmaceutical sectors was stolen. In recent years, defense organizations and military contractors around the world have been targeted by hackers affiliated with the governments of Iran, Russia, North Korea, and China.