Microsoft identified a new custom multi-stage backdoor, “Tickler,” deployed by the Iranian state-sponsored threat actor Peach Sandstorm between April and July 2024.  Targeting sectors like satellite, communications equipment, oil and gas, and government, Tickler has been used to gather intelligence. Peach Sandstorm also conducted password spray attacks on educational and government sectors.  The group employed social engineering techniques on LinkedIn to target higher education, satellite, and defense organizations, while Microsoft assesses Peach Sandstorm’s operations are aligned with the Iranian IRGC’s interests and aims to facilitate intelligence collection.

Source: GBHackers