Cyber Espionage Alert: Iranian Hackers Target Satellite, Defense, and Pharma🔒💻 | Sep 16, 2023
Channel: Hacking Space Frontier
Date: 2023-09-16

Hackers with ties to the Iranian government, specifically a group known as Peach Sandstorm (formerly Holmium), conducted a widespread espionage campaign targeting thousands of organizations across various sectors, including satellite, defense, and pharmaceutical industries. Microsoft has reported on these activities and the methods used in their recent campaign. Here's a summary of the key points:

1. **Scope of the Campaign**: The hacking group Peach Sandstorm, believed to be linked to the Iranian government, targeted thousands of organizations, although Microsoft did not disclose the specific countries involved. Previous attacks associated with Iran focused on countries like Israel, the U.S., Brazil, and the United Arab Emirates.

2. **Campaign Timeline**: The campaign ran from February to July and aimed to collect intelligence in support of Iranian state interests.

3. **Attack Techniques**: The hackers used a technique called "password spraying" to gain unauthorized access to their targets. This method involves trying a single password or a list of commonly used passwords to increase their chances of success without triggering account lockouts.

4. **Tool Utilization**: Peach Sandstorm employed a combination of publicly available and custom tools to compromise targets. They used tools like AzureHound and Roadtools to collect information from victim systems, access data in cloud environments, and transfer specific data to a single database. They also installed the Azure Arc client on compromised devices, giving them control over the devices from their cloud infrastructure.

5. **Exploiting Vulnerabilities**: The group also took advantage of known vulnerabilities, including one in Zoho ManageEngine and another in the team collaboration tool Confluence.

6. **Use of Commercial Tools**: Peach Sandstorm used AnyDesk, a commercial remote monitoring and management tool, to maintain access to their targets. Such tools are considered a potential threat by cybersecurity authorities as they can help hackers bypass security systems and maintain long-term access to victim networks.

7. **Concerns and Impact**: Microsoft expressed concern over the capabilities demonstrated in this campaign. Even initial access by foreign hackers could have adverse consequences for the victims.

8. **Related Developments**: In addition to Peach Sandstorm, another group known as Ballistic Bobcat or Charming Kitten, also with suspected ties to Iran, was found using a new backdoor tool against targets in Brazil, Israel, and the UAE. Microsoft reports that Iranian state-backed hackers are increasingly using influence operations to amplify the impact of their cyberattacks and promote Iran's political agenda, particularly in Israel and the U.S.

Overall, these findings highlight ongoing cyber-espionage activities by Iranian-linked groups and their evolving tactics in pursuit of state interests.