Iranian cyberspies target US defense orgs with a brand new backdoor

Infosec roundup: Microsoft and Mandiant report Iran-linked Peach Sandstorm/APT33 using a custom FalseFont backdoor to target defense industrial base employees, alongside credential-stuffing/password-spray campaigns and observed data exfiltration; separately, law enforcement and security firms uncovered a JS-sniffer operation that infected 443 e-commerce sites to skim payment data, and multiple critical vulnerabilities (including a Chrome WebRTC heap overflow CVE-2023-7024 reportedly under active exploitation) and high-severity flaws in enterprise and ICS products were disclosed.