MalwareUsed by 2 actors

Tickler

Tickler is a custom multi-stage Windows backdoor deployed by the Iranian state-sponsored threat actor Peach Sandstorm, also tracked as APT33, in 2024. It has targeted satellite, communications equipment, oil and gas, defense, and U.S. federal and state government organizations, principally in the United States and the United Arab Emirates, in support of Iranian intelligence-collection objectives. Tickler has been delivered in decoy-laden archives and evolved to use DLL sideloading with legitimate signed Windows binaries. It communicates with attacker-controlled Azure infrastructure, including Azure App Service resources, to beacon, retrieve additional payloads, and receive tasking. Its supported functions include host and network discovery, directory enumeration, command execution, file deletion, configurable beacon intervals, and file upload and download. Tickler establishes persistence through Windows Registry Run-key execution and employs legitimate binaries for defense evasion.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT33

The content cites unverified third-party reporting that APT33 may host Tickler backdoor C2 infrastructure on fraudulent Azure subscriptions.

via codebycodeby.net

Fatimiyoun Electronic Team

In 2024, they... deployed Tickler malware against US and UAE satellite, government, and energy sectors.

via polyswarmblog.polyswarm.io

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583.004ServerEvidence1

APT33 uses Azure Active Directory (AAD) and Azure subscriptions as C2 infrastructure. Their custom malware, Tickler, was observed communicating with attacker-controlled Azure resources.

Initial Access

2 techniques

T1566PhishingEvidence2

These actors maintain mature IT-centric tradecraft—phishing, credential theft, webshelling, and custom backdoors

T1566.001Spearphishing AttachmentEvidence1

The first sample was contained in an archive file named Network Security.zip alongside benign PDF files used as decoy documents.

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The batch script adds a registry Run key for a file called SharePoint.exe, likely used to load the malicious DLL files above, thus setting up persistence

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

The batch script adds a registry Run key for a file called SharePoint.exe, likely used to load the malicious DLL files above, thus setting up persistence

Stealth

1 technique

T1036MasqueradingEvidence1

The archive file contained: YAHSAT NETWORK_INFRASTRUCTURE_SECURITY_GUIDE_20240421.pdf.exe – the Tickler malware

Discovery

1 technique

T1082System Information DiscoveryEvidence1

The sample collects the network information from the host and sends it to the C2 URI via HTTP POST request

Command and Control

3 techniques

T1071Application Layer ProtocolEvidence2

Peach Sandstorm deployed a new custom multi-stage backdoor, Tickler, and leveraged Azure infrastructure hosted in fraudulent, attacker-controlled Azure subscriptions for command-and-control (C2).

T1071.001Web ProtocolsEvidence1

The sample collects the network information from the host and sends it to the C2 URI via HTTP POST request

T1105Ingress Tool TransferEvidence1

The malware downloads additional payloads from the C2 server, including a backdoor, a batch script to set persistence for this backdoor

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app5 months ago

hash.sha256●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

10 SOURCESView more in app

codebyNews

Aug 27, 2026

Screening Serpens: анализ малвари 6 RAT и детекция

A backdoor mentioned only as a comparison to alleged APT33 Azure-hosted C2 practices; it is not linked to the Screening Serpens campaigns under analysis.

krypt3ia wordpressNews

Apr 30, 2026

Threat Intelligence Report: IRGC-Affiliated OT/IoT Malware Evolution | Krypt3ia

A multi-stage implant/custom backdoor referenced as part of IRGC-linked enterprise intrusion tradecraft used for persistent access in enterprise environments.

polyswarmNews

Mar 6, 2026

Cyber Strategy Under Fire: Iranian APT and Proxy Retaliation Risks

Malware deployed in targeted intrusions affecting satellite, government, and energy-related targets (as described in the report).

polyswarmNews

Jul 8, 2025

An Eye on Iran

Malware used by Peach Sandstorm (APT33) for targeting satellite, government, and energy sectors.

+6 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Tickler