Microsoft researchers have published a new report on the Iran-backed threat group APT35 (otherwise known as HOLMIUM, Refined Kitten, and Peach Sandstorm) targeting organizations across the globe with password spray attacks since February 2023. Password spraying is a technique where actors utilize a single password or a list of commonly used passwords in order to authenticate to various accounts. Researchers emphasized that this type of attack allows actors to “maximize their chances for success and minimize the likelihood of automatic account lockouts.” In this campaign, APT35 “demonstrated interest in US and other country’s organizations in the satellite, defense, and to a lesser extent, pharmaceutical sectors” to attempt to access various environments and exfiltrate sensitive information for suspected intelligence collection in support of Iranian state interests. To do this, APT35 utilized publicly available and custom tools as well as different combinations of tactics, techniques, and procedures (TTPs) between the earlier and later attacks in the campaign. The threat group was observed utilizing “AzureHound”, a Go binary that gathers data from Microsoft Entra ID and Azure Resource Manager, as well as “Roadtools”, a framework used to access Microsoft Entra ID, to collect cloud environment data and dump the data of interest into a database. APT35 also attempted to exploit the following vulnerabilities through public proof-of-concepts: CVE-2022-47966 (a remote code execution flaw impacting Zoho ManageEngine products) and CVE-2022-26134 (a remote code execution flaw in Confluence Server and Data Center). APT35 commonly targets organizations in the United States, Saudi Arabia, and South Korea within the government, defense, research, engineering, and finance industries. CTIX analysts will continue to monitor APT35’s latest campaign and provide updates accordingly. Indicators of compromise (IOCs) as well as additional technical details can be viewed in the report linked below.