Recently, Microsoft has disclosed the activities of an Iranian cyber espionage group, known as Peach Sandstorm (previously recognized as Holmium and also referred to as APT33, Elfin, and Refined Kitten).

This group is now deploying a sophisticated malware, named FalseFont backdoor, in intelligence operations targeting defense industry companies worldwide.

Peach Sandstorm’s primary focus is on the US Defense Industrial Base (DIB), a critical sector comprising numerous American and foreign entities and subcontractors working for the US Department of Defense (DOD) and other Federal departments. Microsoft’s Threat Intelligence Unit, a global consortium of security experts, has been diligently monitoring the activities of this group.

Peach Sandstorm’s relentless efforts to infiltrate the DIB with the FalseFont backdoor pose a significant threat. The DIB, which includes hundreds of thousands of entities, is a prime target for these espionage activities, raising serious concerns about potential impacts on national security.

The FalseFont malware emerged in early November 2023, drawing immediate attention from Microsoft’s investigative team. According to their findings, Peach Sandstorm is actively involved in intelligence gathering, presumably for the Iranian government. Although Microsoft has not directly linked the cyber-espionage to a specific Iranian government entity, the group’s historical associations with the Islamic Revolution Guard Corps (IRGC) are notable.

The IRGC is recognized for its extensive cyber army, known for suppressing internet access in Iran, conducting cyber surveillance, engaging in disinformation campaigns abroad, and orchestrating sophisticated hacking operations against Western and other targets.

This revelation adds to Microsoft’s previous reports, which in September 2023 identified Peach Sandstorm targeting sectors like satellites and pharmaceuticals, indicating a strategic effort to gather intelligence across diverse industries.

Earlier in 2023, Microsoft issued alerts about potential influences from Russia, Iran, and China in the upcoming 2024 elections in the United States and other countries. The company’s Threat Analysis Center confirmed that Iran has intensified its cyberattacks and influence operations since 2020.

The escalating threat posed by groups like Peach Sandstorm underscores the growing and persistent danger to global cybersecurity. As state-sponsored actors, such as those linked to the Iranian cyber-espionage efforts, continue to evolve their capabilities, they exploit vulnerabilities for geopolitical gains.

In light of these mounting cyber threats and intelligence-gathering activities by Iranian cyber-espionage groups, there are increasing calls within the international community to designate the IRGC as a terrorist organization.

Advocates believe that such a designation could effectively curb the regime’s cyber operations, intensify global efforts to maintain peace, and enhance cybersecurity measures. This proposal highlights the urgency to confront state-sponsored cyber threats and unite against the sophisticated tactics of such adversaries.