Cyber Threat Report: 'Curious Serpens’ FalseFont Backdoor: Technical Analysis, Detection and Prevention'

This article by researchers at Unit 42 discusses the FalseFont backdoor used by Curious Serpens, an Iranian-affiliated espionage group targeting aerospace and energy sectors. Curious Serpens, also known as Peach Sandstorm, APT33 and REFINED KITTEN has been active since at least 2013, focusing on espionage in various regions. The post provides a technical analysis of FalseFont, detailing its capabilities which include credential theft, file upload/download and screen capture.