Peach Sandstorm should be treated as a serious identity-first threat, not just another malware group. The actor routinely targets exposed accounts, cloud services, email systems, and remote access paths before moving toward espionage goals. If your organization works in defense, energy, satellite communications, government, or research, this group belongs on your security radar.

TLDR: Peach Sandstorm is an Iran-linked threat actor known for credential attacks, cloud abuse, custom malware, and long-running espionage campaigns. A common pattern is simple but painful: spray passwords across hundreds or thousands of accounts, find one weak login, then expand quietly. For example, if a company has 4,000 cloud users and only 8% lack strong multifactor authentication, that still leaves 320 accounts that can become a starting point. Defenders should focus on identity hardening, cloud logging, phishing resistance, and fast investigation of unusual login behavior.

Who Is Peach Sandstorm?

Peach Sandstorm is Microsoft’s name for an Iranian state-sponsored threat actor. Security researchers have linked portions of its activity to names such as APT33, Elfin, and HOLMIUM, though naming can vary by vendor. The group has been active for years and is best known for targeting organizations that hold strategic value for Iran.

Its preferred victims often include:

  • Defense contractors and aerospace suppliers
  • Satellite and communications firms
  • Oil and gas companies
  • Government agencies
  • Universities and research labs
  • Pharmaceutical and technology organizations

The group’s main goal is usually espionage. It wants access, documents, emails, credentials, and technical data. In some reporting, related Iranian activity has also been associated with disruptive operations, but Peach Sandstorm is most often discussed in the context of intelligence collection and persistent access.

Why This Actor Gets Attention

Peach Sandstorm does not always rely on flashy zero-day exploits. That is what makes it annoying. The group often starts with basic identity attacks, then mixes in custom tools once it has a foothold. Honestly, it feels like the cyber version of checking every unlocked door in a business park until one opens.

This approach works because many organizations still have gaps in account protection. Old accounts linger. Service accounts use weak passwords. Multifactor authentication is missing from edge cases. Logs exist, but nobody reviews them fast enough. Peach Sandstorm benefits from all of that.

Reported Campaigns and Activity

Microsoft and other security teams have reported several Peach Sandstorm campaigns targeting high-value sectors. One notable pattern involved password spraying against thousands of accounts across U.S. and international organizations. Instead of trying many passwords against one account, password spraying tries a small number of common passwords across many accounts. This helps avoid some lockout rules.

In reported 2023 activity, the group targeted sectors such as defense, satellite, pharmaceutical, and government. After gaining access, the actor was observed attempting to collect information, maintain access, and move into cloud resources. The cloud angle matters. Many defenders still treat cloud accounts as “just email,” while attackers see them as maps, file stores, identity hubs, and admin consoles.

In 2024 reporting, Microsoft described Peach Sandstorm activity involving a custom backdoor known as Tickler. This activity reportedly affected organizations in areas such as satellite services, communications equipment, oil and gas, and government. The use of custom malware showed that the group can move beyond credential attacks when the target justifies the effort.

Security researchers have also discussed social engineering tied to Iranian actors, including fake professional profiles and contact through business platforms. In these cases, the attacker may pose as a recruiter, researcher, vendor, or industry peer. The target receives a link or file that appears work-related. The first click may not look dramatic. That is the problem.

Common Attack Techniques

Peach Sandstorm’s playbook is practical. It often blends low-noise access attempts with selective malware use. Defenders should watch for the following behaviors.

  • Password spraying: Repeated login attempts using common passwords across many users.
  • Credential theft: Collection of usernames, passwords, tokens, and session data.
  • Cloud account abuse: Access to mailboxes, file repositories, admin panels, and application registrations.
  • Spear phishing: Targeted messages built around job roles, projects, or industry themes.
  • Remote access tools: Use of legitimate tools to blend into normal IT activity.
  • Custom malware: Backdoors such as reported Tickler activity for persistence and remote control.
  • Persistence methods: New accounts, altered permissions, scheduled tasks, or cloud configuration changes.
  • Reconnaissance: Searching emails, directories, group memberships, and internal documents.

The catch is that many of these actions look boring in isolation. One failed login from a foreign IP may not cause panic. A new inbox rule may seem harmless. A strange OAuth consent prompt may get ignored. Together, they can show an intrusion in progress.

What Defenders Should Prioritize

Identity security is the first line of defense. If Peach Sandstorm cannot get a usable account, many intrusions fail early. Organizations should enforce strong multifactor authentication across all users, especially administrators, executives, engineers, researchers, and remote access users.

Better yet, use phishing-resistant MFA where possible. Hardware security keys and certificate-based methods are stronger than push notifications. Push fatigue is real. Users get tired, tap approve, and attackers get in. Expect to waste time later if your only control is a pop-up that employees see ten times a day.

Key defensive steps include:

  1. Block legacy authentication. Old protocols often bypass modern protections.
  2. Enforce conditional access. Require stronger checks for risky locations, devices, and roles.
  3. Monitor failed login patterns. Look for broad attempts across many users.
  4. Review cloud permissions. Remove stale admin roles and unused app permissions.
  5. Audit inbox rules. Attackers often hide or forward messages after mailbox access.
  6. Protect service accounts. Use long random secrets, rotation, and tight scope.
  7. Log everything important. Cloud identity, endpoint, email, VPN, DNS, and proxy logs all matter.

Detection Ideas That Actually Help

Security teams should build detections around behavior, not just known indicators. Infrastructure changes. Malware changes. Behavior often repeats.

Useful alert patterns include:

  • Many failed logins against many accounts from the same network range
  • Successful login after repeated failures from unusual geography
  • Mailbox access followed by mass search activity
  • New forwarding rules or hidden inbox rules
  • New device enrollment shortly after a risky sign-in
  • Unusual OAuth application consent requests
  • Remote access tool execution on non-IT workstations
  • Admin role assignment outside approved change windows

Speed matters. If your team reviews identity alerts once a week, the attacker has too much time. A practical target is to triage high-risk sign-ins within 15 to 30 minutes. That may sound aggressive, but account abuse moves fast.

Incident Response Tips

If Peach Sandstorm activity is suspected, do not only reset the obvious password. That may leave tokens, sessions, rules, and secondary access paths alive.

  • Revoke active sessions for affected accounts.
  • Reset credentials and rotate secrets for connected services.
  • Check mailbox rules, forwarding settings, and delegated access.
  • Review cloud audit logs for privilege changes and application activity.
  • Inspect endpoints for remote tools, scripts, and persistence.
  • Preserve evidence before wiping systems.
  • Hunt laterally for related sign-ins, IPs, devices, and user agents.

Building Long-Term Resilience

Peach Sandstorm succeeds when identity controls are weak and cloud activity is poorly watched. The fix is not one product. It is a security program that treats accounts as high-value assets.

Run regular password spray simulations. Measure MFA coverage by role, not just overall percentage. Review every external-facing system. Train users on targeted social engineering, especially staff in defense, research, legal, finance, and executive teams. Keep email security tight, but assume some messages will still land.

Threat intelligence also helps, but only when it becomes action. Map reported Peach Sandstorm techniques to your controls. Ask simple questions. Can you detect password spraying today? Can you revoke sessions quickly? Can you see risky OAuth grants? Can you tell which files a compromised user touched?

The strongest defense against Peach Sandstorm is disciplined identity security backed by fast monitoring. Malware may get the headlines, but stolen access is often the real story. Close that gap first, and the attacker’s job gets much harder.