- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(high confidence)
- Sponsor
- Iran (Islamic Republic of)
- Motivation
- Information Operations; Information theft and espionage
- Seen
- 2018
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0283 · cotton-sandstorm
IranWhat it is
Cotton Sandstorm is an Iranian threat actor involved in hack-and-leak operations. They have targeted various organizations, including the French satirical magazine Charlie Hebdo, where they obtained and leaked personal information of over 200,000 customers. The group has been linked to the Iranian government and has been sanctioned by the US Treasury
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- HAYWIRE KITTEN
- Microsoft
- DEV-0198
- Operations
- Operation ViceLeaker
- Other names
- ViceLeaker, Emennet Pasargad, Holy Souls, MARNANBRIDGE, NEPTUNIUM, Vice Leaker
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Targets
- Countries
- Europe, Israel, Middle East, United States
- Sectors
- Civil Society, Energy, Finance, Government, High-Tech, NGOs, Rail, Telecoms
Tools
The tools and malware families the sources tie to it.
- Androrat
- Archelaus Beta
- Client Maximus
- ClientMesh
- DroidJack
- MobileOrder
- ViceLeaker
Sources
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de