Actors Insights|Latest update08/07/2026

Peach Sandstorm

Named by MicrosoftSuspected state sponsor: Islamic Republic of Iran

Peach Sandstorm is Microsoft's current name for the Iranian nation-state threat actor known across the industry as APT33. Active since at least 2013, the group conducts espionage operations targeting organizations in the satellite, defense, aerospace, energy, and pharmaceutical sectors globally. Peach Sandstorm is best known for conducting large-scale password spray campaigns against thousands of organizations, followed by stealthy post-compromise activity using cloud-based tools such as AzureHound, Roadtools, and the TICKLER backdoor to collect intelligence in support of Iranian state interests.

This threat actor previously was known as HOLMIUM
First Seen:Jan 2013
Last Seen:Mar 2026
Indexed Reports:4
Public IOCs:37
Cluster: APT33Mitre: APT33Misp: APT33
also known as:
APT 33Elfin (Symantec)Magnallium (Dragos)Refined Kitten (CrowdStrike)HOLMIUM (Microsoft)COBALT TRINITY (SecureWorks)G0064 (Mitre)ATK35 (Thales)Peach Sandstorm (Microsoft)TA451 (Proofpoint)

Targeted Regions

Australia
AU
Australia
Australia
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
United States
US
United States
United States
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Dec 2023 ~ Jan 2024
Nov 2021 ~ Aug 2024
Dec 2023 ~ Jan 2024
Nov 2021 ~ Aug 2024
Nov 2021 ~ Aug 2024
Jan 2021Oct 2026

Targeted Sectors

DefenseAerospaceGovernment Agencies and ServicesEducationOil and GasTelecommunicationPharmaceuticals

Recent Indexed Reports

  1. Public
    Peach Sandstorm Targets US and UAE Critical Sectors with Tickler Malware
  2. Public
    Peach Sandstorm's FalseFont Backdoor Targets Defense Industrial Base
  3. Public
    Peach Sandstorm’s Multi-Faceted Attacks on Satellite, Defense, and Pharma Sectors

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.