Ankura CTIX FLASH Update - August 30, 2024

Malware Activity

New Backdoor "Tickler" Used Against Government and Defense Sectors

Microsoft security researchers have observed a new custom multi-stage backdoor named "Tickler" deployed by threat actor Peach Sandstorm between April and July 2024. Peach Sandstorm – or APT33 – is believed to operate on behalf of the Iranian Islamic Revolutionary Guard Corps (IRGC) based on the group's victimology. Researchers have observed Tickler used in attacks against satellite, communications equipment, oil and gas, and federal and state government sectors in both the United States and United Arab Emirates. In the attacks deploying Tickler, Peach Sandstorm also leveraged Azure infrastructure hosted in fraudulent attacker-controlled Azure subscriptions for command-and-control (C2). The Azure infrastructure used by Peach Sandstorm was procured by compromising user accounts in the education sector, which allowed the threat actor to create Azure for Students subscriptions and