Iranian hackers infiltrate US defense orgs using advanced cyber backdoor.

Iranian cyberspies have targeted US defense organizations with a new backdoor called FalseFont, according to Microsoft. The malware allows operators to remotely access infected systems, launch additional files, and send information to command and control servers. The backdoor was first observed being used against targets in November 2023. The threat hunters at Mandiant, who track the Iran-backed group as APT33, say the group targets organizations in the US, Saudi Arabia, and South Korea for “strategic cyberespionage”. They have a particular interest in commercial and military aviation companies, as well as those in the energy sector with ties to petrochemical production.