Curious Serpens

Peach Sandstorm, also known as Curious Serpens, APT33, and Elfin, is an Iranian state-aligned threat actor assessed to support espionage and disruptive cyber operations. The group has been active since at least 2013 and has been linked in multiple reports to Iranian government interests, with suspected ties to the Islamic Revolutionary Guard Corps. It has historically targeted organizations in the aerospace, defense, energy, and information technology sectors, with activity spanning the United States, the Middle East, and Europe. The actor is known for credential-based intrusion activity, including password spraying, followed by post-compromise discovery and persistence in Microsoft cloud environments. Recent reporting associates Peach Sandstorm with abuse of Azure-focused offensive tooling such as AzureHound and ROADtools to enumerate Microsoft Entra ID tenants, users, groups, roles, devices, applications, and privilege relationships. This tradecraft reflects a broader shift toward living-off-the-land and legitimate API abuse in cloud environments, enabling reconnaissance, defense evasion, and persistence while blending with normal administrative activity. Peach Sandstorm has also been associated with custom malware and backdoors, cloud-enabled command-and-control, and destructive operations. Reporting links the broader actor cluster to disk-wiping and disruptive malware campaigns, and some assessments describe exploitation of vulnerabilities, including zero-days, as well as supply-chain targeting. Across campaigns, the group’s behavior is consistent with strategic intelligence collection and preparation for disruptive effects against sectors of geopolitical importance to Iran.