{"id":54926,"date":"2023-12-23T15:46:34","date_gmt":"2023-12-23T15:46:34","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/iranian-cyberspies-target-us-defense-orgs-with-a-brand-new-backdoor\/"},"modified":"2023-12-23T15:46:34","modified_gmt":"2023-12-23T15:46:34","slug":"iranian-cyberspies-target-us-defense-orgs-with-a-brand-new-backdoor","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/iranian-cyberspies-target-us-defense-orgs-with-a-brand-new-backdoor\/","title":{"rendered":"Iranian cyberspies target US defense orgs with a brand new backdoor"},"content":{"rendered":"

Infosec in brief<\/span> Iranian cyberspies are targeting defense industrial base organizations with a new backdoor called FalseFont, according to Microsoft.<\/p>\n

In a series of Xeets<\/a> posted Thursday, Redmond’s threat intel team said it spotted a nation-state backed gang it calls Peach Sandstrom attempting to deliver the (presumably Windows) malware to defense-sector employees.<\/p>\n

“FalseFont is a custom backdoor with a wide range of functionalities that allow operators to remotely access an infected system, launch additional files, and send information to its C2 servers,” Microsoft said. “It was first observed being used against targets in early November 2023.”<\/p>\n