Actors Insights|Latest update20/02/2025

Phosphorus

Named by MicrosoftSuspected state sponsor: Islamic Republic of Iran
This threat actor's name is changed to Mint Sandstorm
First Seen:Sep 2020
Last Seen:Jan 2024
Indexed Reports:9
Public IOCs:137
Cluster: Charming KittenMitre: Magic HoundMisp: APT35
also known as:
APT35 (Mandiant)APT42 (Mandiant)COBALT ILLUSION (SecureWorks)Charming Kitten (CrowdStrike)COBALT MIRAGE (SecureWorks)G0059 (Mitre)ITG18 (IBM)Magic Hound (Palo Alto)Mint Sandstorm (Microsoft)Newscaster Team (Symantec)TA453 (Proofpoint)TunnelVision (SentinelOne)

Targeted Regions

Belgium
BE
Belgium
Belgium
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Europe
EU
Europe
Europe
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
France
FR
France
France
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Israel
IL
Israel
Israel
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Jun 2022 ~ Jun 2022
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Middle East
ME
Middle East
Middle East
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
Palestine
PS
Palestine
Palestine
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
United Kingdom
GB
United Kingdom
United Kingdom
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
United States
US
United States
United States
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Jun 2022 ~ Jun 2022
May 2022 ~ Jun 2022
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Jan 2020Oct 2025

Targeted Sectors

Government Agencies and ServicesResearchersJournalistsPro-DemocracyPoliticalEducationDefenseMilitaryUniversityConstructionHuman RightsLogisticsEnergyOil and GasUtilities

Recent Indexed Reports

  1. Public
    Mint Sandstorm Subgroup Targets US Critical Infrastructure
  2. Public
    Phosphorus Targets Israeli and US Officials with Spear-Phishing
  3. Public
    Stealth in the System: PHOSPHORUS Exploits Exchange Server in Infrastructure Sector Attack
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.