APT33, which Microsoft calls Peach Sandstorm, is an Iranian espionage group that gets into high-value organisations mostly by guessing passwords at scale and then turning a single cloud account into persistent Azure infrastructure of its own. Its recent campaigns sprayed thousands of Microsoft Entra ID tenants, created attacker-controlled Azure subscriptions inside and outside victim tenants, and forged SAML tokens with stolen AD FS keys. This profile is written identity first for Entra ID administrators, cloud security teams and SOC analysts in aerospace, satellite, defence, energy, government and education. It covers names and attribution, targeting, ATT&CK techniques, the identity abuse pattern in detail, notable campaigns to 2024 and a detection and hardening plan. Generic spraying defence is in the Password Spraying and Credential Stuffing Defence Guide; this page focuses on what is specific to this actor.
Key takeaways
- Spraying is the main door. Microsoft observed Peach Sandstorm spraying thousands of organisations between February and July 2023, and again in 2024, often through TOR or commercial VPN infrastructure.
- The goal after sign-in is Azure, not the mailbox. The group ran AzureHound or ROADtools, created new Azure subscriptions, used Azure Arc to connect victim machines to a subscription it controlled, and hosted command and control on Azure App Service.
- Federation keys mean forged identities. In a March 2023 intrusion it stole AD FS private keys to forge SAML tokens (Golden SAML).
- Education tenants are infrastructure. Microsoft reports compromised education accounts were used to obtain Azure for Students subscriptions for attacker infrastructure, so universities are targets even when they are not the intelligence objective.
- Revoke sessions, not just passwords. Microsoft's guidance after a successful spray is to reset passwords, revoke session cookies and remove attacker-made MFA changes, and to require MFA re-challenge for MFA registration.
Who they are (names and aliases)
MITRE ATT&CK tracks the group as APT33 (G0064), a suspected Iranian threat group active since at least 2013. Mandiant's 2017 report assessed that it operates at the behest of the Iranian government, and Microsoft assessed in August 2024 that Peach Sandstorm operates on behalf of the Islamic Revolutionary Guard Corps (IRGC) in support of intelligence collection.
| Name | Tracked by | Notes |
|---|---|---|
| APT33 | Mandiant / Google, ATT&CK | Original public name, September 2017 |
| Peach Sandstorm (earlier HOLMIUM) | Microsoft | Name used in the 2023 and 2024 cloud-focused reporting |
| Elfin | Symantec | Listed as an associated name in ATT&CK |
Do not confuse APT33 with other Iranian groups that share some targets: see the Charming Kitten (APT35) Threat Actor Profile, the MuddyWater Threat Actor Profile and the Iran State Cyber Operations Guide.
Targeting and motivation
- Historic focus: Mandiant's 2017 report describes aviation and aerospace organisations with military and commercial roles, and energy organisations with petrochemical ties, in the United States, Saudi Arabia and South Korea, using recruitment-themed lures.
- 2023: Microsoft reported spraying focused on satellite, defence and, to a lesser extent, pharmaceutical organisations worldwide, with earlier targeting of aviation, energy, healthcare, government and telecommunications.
- 2024: Tickler malware was deployed against satellite, communications equipment, oil and gas, and federal and state government organisations in the United States and the United Arab Emirates. Education organisations were sprayed to obtain infrastructure, and organisations in Australia were also sprayed.
- Motivation: intelligence collection. Mandiant linked the group's DROPSHOT dropper to the SHAPESHIFT wiper but stated it had not directly observed APT33 carrying out destructive operations.
- Working pattern: Microsoft observed spray activity in late May and June 2023 almost entirely between 09:00 and 17:00 Iran Standard Time, a useful hunting filter.
Tactics and techniques (MITRE ATT&CK)
Techniques mapped to G0064 in ATT&CK v20 are marked (G). Others are from Microsoft's 2023 and 2024 reports and mapped by NHI Mgmt Group to the closest v20 technique.
| Tactic | Technique | How it shows up |
|---|---|---|
| Credential access | T1110.003 Password Spraying (G) | One password or a short list against many accounts; TOR and commercial VPN sources; go-http-client user agent in 2023 |
| Initial access | T1078.004 Cloud Accounts (G) | Valid Entra ID and Microsoft 365 accounts; earlier use of Office 365 accounts with the Ruler tool |
| Initial access | T1190 Exploit Public-Facing Application | Public exploits for Zoho ManageEngine (CVE-2022-47966) and Confluence (CVE-2022-26134) |
| Initial access | T1566.002 Spearphishing Link (G); T1566.003 Spearphishing via Service | Recruitment lures to HTML applications; LinkedIn profiles posing as students, developers and recruiters; ZIP via Microsoft Teams |
| Resource development | T1585.001 Social Media Accounts; T1583.006 Web Services | Fake LinkedIn personas; Azure tenants, Azure for Students subscriptions and App Service domains for C2 |
| Discovery | T1087.004 Cloud Account; T1580 Cloud Infrastructure Discovery | AzureHound or ROADtools enumeration of Entra ID; AD Explorer snapshot of on-premises AD |
| Persistence, stealth | T1578.002 Create Cloud Instance | New Azure subscriptions and VMs in compromised tenants running the EagleRelay tunnelling tool |
| Credential access | T1552.004 Private Keys; T1606.002 SAML Tokens | AD FS private keys stolen to forge SAML tokens |
| Credential access | T1003.001 LSASS Memory, T1555.003 Credentials from Web Browsers, T1552.006 Group Policy Preferences (G) | Mimikatz, LaZagne and GPP password tools on hosts |
| Command and control | T1219.002 Remote Desktop Software | AnyDesk for access in some intrusions |
| Stealth, execution | T1574.001 DLL | DLL search order hijack of a legitimate VMware executable; Tickler side-loading |
| Lateral movement | T1021.002 SMB/Windows Admin Shares; T1021.001 RDP | SMB at a European defence organisation; RDP attempted from Azure VMs |
| Persistence | T1546.003 WMI Event Subscription (G); T1547.001 Run Keys | WMI subscriptions in earlier campaigns; Run key for Tickler |
How they abuse identities and credentials
The Peach Sandstorm pattern is a chain of identity decisions an attacker makes with one guessed password. Each step maps to a control the defender owns.
| Step | What the actor does | Identity control that breaks it |
|---|---|---|
| 1. Guess | Low-volume spray across many tenants and accounts, from anonymising networks | Phishing-resistant MFA for all users; block legacy authentication; banned password lists; AD FS extranet lockout |
| 2. Sign in | Valid password without MFA, or through a legacy protocol | Conditional Access requiring MFA and compliant device; block sign-ins from anonymiser IPs where acceptable |
| 3. Enumerate | AzureHound or ROADtools to map users, groups, roles and applications | Restrict default user permissions to read directory data; alert on bulk Graph enumeration |
| 4. Persist | Register MFA methods, create Azure subscriptions, connect devices through Azure Arc | MFA re-challenge for security info changes; restrict who can create subscriptions and move them into the tenant; govern Arc onboarding service principals |
| 5. Escalate | Steal AD FS signing keys to forge SAML tokens | Treat AD FS as Tier 0 or migrate to cloud authentication; monitor token signing certificate access |
| 6. Operate | Run tunnelling VMs and remote access tools, use Azure-hosted C2 | Cost and resource alerts on new subscriptions; egress controls; EDR on cloud VMs |
- Non-human identities in the chain: Azure Arc onboarding uses a service principal or interactive admin consent; a subscription created by an attacker carries its own owners and managed identities. Inventory who owns every subscription and service principal. See the Azure Arc-Enabled Servers Security Guide.
- Federation as a single point of failure: once AD FS keys are stolen, MFA and password resets do not stop forged tokens; only rotating the token signing certificate does. The SolarWinds Golden SAML case shows the same failure mode.
- MFA registration as persistence: Microsoft explicitly recommends removing attacker-made MFA changes and requiring re-challenge for MFA updates, because a newly registered method survives a password reset. See the MFA Fatigue and Bypass Guide.
- Accounts that cannot use MFA: shared, service and legacy-protocol accounts are the spray targets that succeed. Convert them to workload identities or exclude them from interactive sign-in. See the Entra ID Security Guide.
Notable incidents
| Date | Campaign | Source |
|---|---|---|
| Mid-2016 to early 2017 | Compromise of a US aerospace organisation; recruitment lures to Saudi aviation and South Korean petrochemical targets | Mandiant, September 2017 |
| February to July 2023 | Mass password spraying of satellite, defence and pharmaceutical organisations; Azure subscription and Azure Arc abuse; Golden SAML in March 2023 | Microsoft Threat Intelligence, 14 September 2023 |
| April to July 2024 | Tickler backdoor in US and UAE organisations; Azure for Students subscriptions used for C2, which Microsoft disrupted | Microsoft Threat Intelligence, 28 August 2024 |
Detection and defence
Detection signals
| Signal | Where | Notes |
|---|---|---|
| Many accounts failing with the same password pattern from TOR, VPN or one ASN | Entra sign-in logs; Identity Protection password spray detection (P2) | Look for low and slow sprays: alphabetical order, repeated user agent, regular timing |
| AD FS Event IDs 411, 342 and 516; 1203 on AD FS 2016 and 2019 | AD FS servers with verbose auditing | Microsoft's password spray playbook lists these as the main indicators |
| Interrupted sign-ins (correct password, MFA not completed) from attacker IPs | Entra sign-in logs | The playbook ranks these just below successful sign-ins in priority |
| Spray activity concentrated in Iranian working hours | SIEM time-of-day analytics | Supporting evidence only; do not rely on it alone |
| Bulk Graph or Azure AD PowerShell enumeration shortly after a new sign-in | Microsoft Graph activity logs, Defender for Cloud Apps | AzureHound and ROADtools produce dense read patterns |
| New subscription created or transferred into the tenant; new Azure Arc machine | Azure Activity Log, Arc resource events | Rarely legitimate outside a planned change |
| New MFA method registered after a risky sign-in | Entra audit logs | Strong persistence indicator |
| Access to AD FS token signing keys or configuration database | AD FS server security logs, EDR | Treat as Golden SAML preparation |
Hardening plan
- Week 1: confirm MFA coverage for every interactive account, block legacy authentication with Conditional Access (report-only first to find broken workflows), and enable Entra Password Protection with a custom banned list.
- Weeks 2 to 4: move administrators and high-value staff to phishing-resistant MFA; require MFA re-challenge for security information registration; restrict users from reading directory data they do not need.
- Weeks 4 to 8: lock subscription creation and transfer into the tenant to named roles; alert on new subscriptions and Azure Arc onboarding; review service principals with subscription owner rights.
- Quarter 1: treat AD FS as Tier 0 or migrate to Entra ID cloud authentication; enable AD FS extranet lockout and Entra Connect Health in the meantime.
- Ongoing: run spray simulations and confirm alerts fire; review EDR on cloud VMs and egress from Azure workloads.
Rollback: a Conditional Access policy that blocks a business-critical legacy client can be returned to report-only immediately; keep an emergency access account excluded from every policy and monitored.
Response after a confirmed spray success
- Contain the account: reset the password, revoke sessions and refresh tokens, remove MFA methods added since the first suspicious sign-in, and mark the user compromised.
- Check the tenant, not just the user: new subscriptions, Arc machines, app registrations, consents and role assignments made by the account.
- If AD FS was touched: rotate the token signing and decryption certificates twice and review relying party trusts.
Metrics
- Accounts able to sign in without MFA: target zero outside documented exceptions.
- Legacy authentication sign-ins per week: trending to zero.
- Time from spray success to session revocation: target under one hour.
- Subscriptions without a named owner: target zero.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev. 5 | AC-7 Unsuccessful Logon Attempts, IA-2(1) Multi-factor Authentication to Privileged Accounts | Lockout and MFA against spraying |
| NIST SP 800-53 Rev. 5 | AC-17 Remote Access, SI-4 System Monitoring | Conditional access and sign-in monitoring |
| NIST CSF 2.0 | PR.AA-01, PR.AA-03, DE.CM-03 | Credential management, authentication, monitoring personnel activity |
Practitioner checklist
- Export a list of every account that can sign in without MFA or through legacy protocols and close each one.
- Enable Identity Protection sign-in and user risk policies where licensed.
- Turn on verbose AD FS auditing and collect Event IDs 411, 342, 516 and 1203 in the SIEM.
- Restrict subscription creation and inbound subscription transfer, and alert on both.
- Alert on new Azure Arc machines and on service principals gaining subscription owner rights.
- Require MFA re-challenge for security information changes.
- Plan AD FS retirement or Tier 0 treatment, and document a token signing certificate rotation runbook.
- Warn staff in target sectors about LinkedIn and Teams approaches posing as students or recruiters.
Standards and references
- MITRE ATT&CK: APT33 (G0064)
- MITRE ATT&CK: Brute Force: Password Spraying
- Microsoft Threat Intelligence: Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets
- Microsoft Threat Intelligence: Peach Sandstorm deploys new custom Tickler malware
- Microsoft Learn: Password spray investigation playbook
- Mandiant: Insights into Iranian cyber espionage, APT33 targets aerospace and energy sectors
Related NHI Mgmt Group resources: Password Spraying and Credential Stuffing Defence Guide · Iran State Cyber Operations Guide · Entra ID Security Guide · Threat Actor Groups Guide