Microsoft security researchers have observed a new custom multi-stage backdoor named “Tickler” deployed by threat actor Peach Sandstorm between April and July 2024. Peach Sandstorm – or APT33 – is believed to operate on behalf of the Iranian Islamic Revolutionary Guard Corps (IRGC) based on the group’s victimology. Researchers have observed Tickler used in attacks against satellite, communications equipment, oil and gas, and federal and state government sectors in both the United States and United Arab Emirates. In the attacks deploying Tickler, Peach Sandstorm also leveraged Azure infrastructure hosted in fraudulent attacker-controlled Azure subscriptions for command-and-control (C2). The Azure infrastructure used by Peach Sandstorm was procured by compromising user accounts in the education sector, which allowed the threat actor to create Azure for Students subscriptions and create resources to use as the C2 for Tickler. Compromised user accounts were achieved through password spray attacks between April and May 2024 targeting the defense, space, education, and government sectors in the US and Australia. Researchers at Microsoft identified two samples of the Tickler malware, each built to collect network information from the compromised host to send back to the attacker via HTTP POST requests. The backdoor is also capable of executing commands, deleting files, and transferring files to and from the attacker-controlled C2 server. Microsoft has announced that starting October 15, 2024, multi-factor authentication (MFA) will be mandatory for all Azure sign-in attempts. For organizations in targeted sectors, CTIX analysts recommend reviewing audit logging for suspicious sign-in activity and performing threat hunting for the indicators of compromise (IOCs) provided by Microsoft. CTIX analysts will continue to report on new and emerging malware and associated campaigns.