Peach Sandstorm deploys new custom Tickler malware in long-running intelligence gathering operations

Between April and July 2024 Microsoft observed Iranian state-sponsored actor Peach Sandstorm deploy a new multi-stage backdoor called Tickler against targets in the satellite, communications equipment, oil and gas, federal and state government, and education sectors, using password-spray, LinkedIn-based intelligence gathering, and attacker-controlled or compromised Azure subscriptions for C2; the report provides technical analysis of samples, IOCs (domains and file hashes), hunting queries, and mitigation guidance.