Microsoft Warns of New ‘FalseFont’ Backdoor Targeting the Defense Sector

Businesses in the Defense Industrial Foundation (DIB) sector are in the crosshairs of an Iranian threat actor as element of a campaign designed to provide a never-just before-found backdoor called FalseFont.

The findings come from Microsoft, which is tracking the exercise under its temperature-themed moniker Peach Sandstorm (previously Holmium), which is also regarded as APT33, Elfin, and Refined Kitten.

“FalseFont is a personalized backdoor with a extensive assortment of functionalities that allow for operators to remotely access an infected process, start additional documents, and send details to its [command-and-control] servers,” the Microsoft Risk Intelligence staff said on X (previously Twitter).

Upcoming WEBINAR Conquer AI-Driven Threats with Zero Rely on – Webinar for Security Pros

Classic security steps won’t lower it in present-day earth. It is really time for Zero Rely on Security. Protected your information like under no circumstances just before.

Join Now

The initially recorded use of the implant was in early November 2023.

The tech large further stated that the most recent growth aligns with previous exercise from Peach Sandstorm and demonstrates a continued evolution of the danger actor’s tradecraft.

In a report posted in September 2023, Microsoft linked the team to password spray attacks carried out towards hundreds of organizations globally concerning February and July 2023. The intrusions mostly singled out satellite, protection, and pharmaceutical sectors.

The end objective, the firm said, is to facilitate intelligence collection in aid of Iranian condition interests. Peach Sandstorm is thought to have been energetic because at least 2013.

The disclosure arrives as the Israel Nationwide Cyber Directorate (INCD) accused Iran and Hezbollah of making an attempt to unsuccessfully focus on Ziv Healthcare facility by way of hacking crews named Agrius and Lebanese Cedar.

The agency also unveiled aspects of a phishing marketing campaign in which a pretend advisory for a security flaw in F5 Massive-IP products and solutions is employed as a decoy to produce wiper malware on Windows and Linux units.

The entice for the specific attack is a critical authentication bypass vulnerability (CVE-2023-46747, CVSS score: 9.8) that arrived to gentle in late Oct 2023. The scale of the marketing campaign is presently unknown.

Uncovered this short article intriguing? Abide by us on Twitter  and LinkedIn to go through extra exceptional written content we put up.

Some parts of this article are sourced from:
thehackernews.com