iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Microsoft says the Iran-linked group it tracks as Peach Sandstorm deployed a custom backdoor called Tickler against organizations in the United States and the United Arab Emirates between April and July 2024. The company described Tickler as a tool for gathering information, running commands, and transferring files—not a consumer product—and assessed that the group’s operations support Iranian state intelligence collection. The report, published August 28, 2024, documents activity through July 2024; it does not establish that the campaign remains active in 2026.
What is Tickler malware?
Tickler is a custom, multi-stage Windows backdoor that Microsoft Threat Intelligence said Peach Sandstorm deployed during the 2024 activity. Microsoft reported that the attackers used Azure infrastructure hosted in fraudulent, attacker-controlled subscriptions for command and control (C2)—the communications channel malware uses to receive instructions and send information.
Microsoft’s technical analysis describes several capabilities across the observed payloads. These are reported behaviors, not proof that every deployment used every function.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Collect system information and list directories.
- Execute commands and delete files.
- Set a sleep interval, which can control how long the malware waits between actions.
- Transfer files to or from C2 infrastructure.
- In a later sample Microsoft analyzed as
sold.dll, download additional payloads and a batch script that added a Windows registry Run key for persistence.
The first described sample was packaged in an archive with benign PDF decoys. Microsoft said the native Windows executable opened a harmless-looking PDF and sent host network information to a C2 URI. The actors also used legitimate signed binaries in a way Microsoft assessed was likely DLL sideloading: loading a malicious library through a trusted program.
#1 Best Overall
Who was targeted?
Microsoft identified Tickler activity against organizations in the United States and UAE in the satellite, communications equipment, oil and gas, and federal and state government sectors. It characterized the activity as intelligence gathering.
The same report described related, but distinct, password-spraying activity. In April and May 2024, Microsoft observed password spraying against defense, space, education, and government organizations in the United States and Australia. Those sectors and countries should not be conflated with the specific target list Microsoft gave for Tickler deployments.
How did Peach Sandstorm gain access?
Microsoft said the group used password spraying or social engineering for initial access. Password spraying means trying one password—or a short list of commonly used passwords—across many accounts. It differs from brute-forcing one account with many password guesses and can reduce the chance of triggering automatic lockouts. Microsoft observed Peach Sandstorm checking valid credentials and later signing in from commercial VPN infrastructure.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Microsoft also reported LinkedIn intelligence gathering and possible social engineering aimed at higher-education, satellite, and defense organizations. From at least November 2021 through mid-2024, it observed profiles posing as students, developers, and talent-acquisition managers based in the United States and Western Europe. Microsoft said the identified accounts were subsequently taken down.
Rank #3
Who is Peach Sandstorm, and what is the Iran connection?
Peach Sandstorm is Microsoft’s tracking name for the activity cluster. Other security vendors use names including APT33 and Refined Kitten; SecurityWeek also lists Elfin, Holmium, and Magnallium. These are vendor-specific labels, and matching aliases do not guarantee that every organization defines the group’s activity in exactly the same way.
Microsoft assesses that Peach Sandstorm operates on behalf of Iran’s Islamic Revolutionary Guard Corps (IRGC), citing victimology and operational focus. The company also assesses that the operations are designed to support Iranian state intelligence collection. These are Microsoft’s attribution judgments, not independently established facts in the report. Microsoft’s exact assessment is that “Peach Sandstorm’s operations are designed to facilitate intelligence collection in support of Iranian state interests.”
What did Microsoft do, and what should organizations do?
Microsoft said it notified affected organizations and disrupted fraudulent Azure infrastructure and accounts associated with the activity. It also reported continued password spraying targeting the education sector to procure infrastructure, and satellite, government, and defense sectors for intelligence collection. That reporting describes activity Microsoft observed in 2024; it does not confirm the campaign’s current status.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor organizations that detect password-spray targeting or suspicious account activity, Microsoft recommended identity-focused response and safeguards:
Best Value
- Reset passwords for accounts targeted in a spray, revoke their session cookies, and check for attacker-made changes to MFA settings. Reverse unauthorized changes and require a fresh MFA challenge when MFA settings are updated.
- Use conditional access, block legacy authentication where possible, and apply least privilege so compromised accounts have less reach.
- Audit privileged-account activity and monitor identity risk for suspicious sign-ins or changes.
- Require MFA for Azure accounts and remote desktop access. Microsoft also suggested considering passwordless authentication.
Microsoft noted that MFA security defaults and its more recent MFA enforcement for Azure accounts can make accounts more resistant to the compromise techniques described. These measures reduce risk; none guarantees protection on its own.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What the report establishes—and what it does not
Microsoft’s August 28, 2024 report records Tickler deployment between April and July 2024 and describes related activity, targeting, and defensive steps. It is historical evidence, not confirmation that the same campaign or infrastructure is active today. It also does not provide a victim count, success rate, or evidence that every capability appeared in every infection. Organizations should use current threat-intelligence and incident-response information to assess their own exposure.
Quick Recap
Sources
- Microsoft Threat Intelligence, August 28, 2024
- CyberScoop, August 28, 2024
- SecurityWeek, August 29, 2024
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
