Loading threat actor…
Peach Sandstorm, also known as Curious Serpens, APT33, and Elfin, is an Iranian state-aligned threat actor assessed to support espionage and disruptive cyber operations. The group has been active since at least 2013 and has been linked in multiple reports to Iranian government interests, with suspected ties to the Islamic Revolutionary Guard Corps. It has historically targeted organizations in the aerospace, defense, energy, and information technology sectors, with activity spanning the United States, the Middle East, and Europe. The actor is known for credential-based intrusion activity, including password spraying, followed by post-compromise discovery and persistence in Microsoft cloud environments. Recent reporting associates Peach Sandstorm with abuse of Azure-focused offensive tooling such as AzureHound and ROADtools to enumerate Microsoft Entra ID tenants, users, groups, roles, devices, applications, and privilege relationships. This tradecraft reflects a broader shift toward living-off-the-land and legitimate API abuse in cloud environments, enabling reconnaissance, defense evasion, and persistence while blending with normal administrative activity. Peach Sandstorm has also been associated with custom malware and backdoors, cloud-enabled command-and-control, and destructive operations. Reporting links the broader actor cluster to disk-wiping and disruptive malware campaigns, and some assessments describe exploitation of vulnerabilities, including zero-days, as well as supply-chain targeting. Across campaigns, the group’s behavior is consistent with strategic intelligence collection and preparation for disruptive effects against sectors of geopolitical importance to Iran.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Iranian threat group observed using ROADtools-like discovery tooling during active intrusions in 2023.
Used ROADtools following password spray campaigns to operate in Microsoft cloud environments.
Iran-linked threat actor associated in this content with disruptive attacks against IT infrastructure using disk-wiping malware.
Suspected IRGC-tied espionage actor emphasizing tailored phishing, supply-chain compromise, and use of zero-days/custom backdoors; reported targeting includes Israeli defense contractors.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.