Actors Insights|Latest update03/12/2024

Phosphorus

Named by MicrosoftSuspected state sponsor: Islamic Republic of Iran
This threat actor's name is changed to Mint Sandstorm
First Seen:Sep 2020
Last Seen:Jan 2024
Indexed Reports:7
Public IOCs:135
Cluster: Charming KittenMitre: Magic HoundMisp: APT35
also known as:
APT35 (Mandiant)APT42 (Mandiant)COBALT ILLUSION (SecureWorks)Charming Kitten (CrowdStrike)COBALT MIRAGE (SecureWorks)G0059 (Mitre)ITG18 (IBM)Magic Hound (Palo Alto)Mint Sandstorm (Microsoft)Newscaster Team (Symantec)TA453 (Proofpoint)TunnelVision (SentinelOne)

Targeted Regions

Belgium
BE
Belgium
Belgium
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Europe
EU
Europe
Europe
Sep 2020 ~ Oct 2020
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
France
FR
France
France
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Israel
IL
Israel
Israel
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Middle East
ME
Middle East
Middle East
Sep 2020 ~ Oct 2020
Palestine
PS
Palestine
Palestine
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Sep 2020 ~ Oct 2020
United Kingdom
GB
United Kingdom
United Kingdom
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
United States
US
United States
United States
Sep 2020 ~ Oct 2020
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
May 2022 ~ Jun 2022
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Jan 2020Nov 2024

Targeted Sectors

JournalistsPro-DemocracyPoliticalResearchersUniversityConstructionHuman RightsLogisticsEnergyOil and GasUtilities

Recent Indexed Reports

  1. Public
    Mint Sandstorm Subgroup Targets US Critical Infrastructure
  2. Public
    Stealth in the System: PHOSPHORUS Exploits Exchange Server in Infrastructure Sector Attack
  3. Public
    PowerLess Backdoor: Analyzing the Phosphorus Group's Cyber Espionage Tool
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.