Ankura CTIX FLASH Update - September 19, 2023

Malware Activity

Iranian Threat Group APT35 Observed Conducting Password Spray Attacks Since February 2023

Microsoft researchers have published a new report on the Iran-backed threat group APT35 (otherwise known as HOLMIUM, Refined Kitten, and Peach Sandstorm) targeting organizations across the globe with password spray attacks since February 2023. Password spraying is a technique where actors utilize a single password or a list of commonly used passwords in order to authenticate to various accounts. Researchers emphasized that this type of attack allows actors to "maximize their chances for success and minimize the likelihood of automatic account lockouts." In this campaign, APT35 "demonstrated interest in US and other country's organizations in the satellite, defense, and to a lesser extent, pharmaceutical sectors" to attempt to access various environments and exfiltrate sensitive information for suspected intelligence collection in support of Iranian state