Actors Insights|Latest update24/07/2026

Phosphorus

Named by MicrosoftSuspected state sponsor: Islamic Republic of Iran

Phosphorus is Microsoft's legacy name for the Iranian threat cluster now formally designated Mint Sandstorm, and widely known as Charming Kitten and APT35. The group has been active since at least 2014 and is linked to the IRGC. Under the Phosphorus name, Microsoft documented campaigns targeting the 2020 US presidential election — including attempts to access accounts of campaign staff and current and former US government officials — as well as attacks against medical researchers and activists. Microsoft retired the Phosphorus name as part of a broader taxonomy update in 2023, replacing it with Mint Sandstorm.

This threat actor's name is changed to Mint Sandstorm
First Seen:Jan 2014
Last Seen:Mar 2026
Indexed Reports:10
Public IOCs:137
Cluster: Charming KittenMitre: Magic HoundMisp: APT35
also known as:
Newscaster Team (Symantec)Magic Hound (Palo Alto)G0059 (Mitre)PHOSPHORUS (Microsoft)Mint Sandstorm (Microsoft)TunnelVision (SentinelOne)COBALT MIRAGE (SecureWorks)Agent SerpensAPT35 (Mandiant)TA453 (Proofpoint)COBALT ILLUSION (SecureWorks)Charming Kitten (CrowdStrike)ITG18 (IBM)

Targeted Regions

Belgium
BE
Belgium
Belgium
Nov 2023 ~ Jan 2024
Europe
EU
Europe
Europe
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
France
FR
France
France
Nov 2023 ~ Jan 2024
Israel
IL
Israel
Israel
Sep 2021 ~ Apr 2023
Jun 2022 ~ Jun 2022
Sep 2021 ~ Apr 2023
Jun 2022 ~ Jun 2022
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Nov 2023 ~ Jan 2024
Middle East
ME
Middle East
Middle East
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
Palestine
PS
Palestine
Palestine
Nov 2023 ~ Jan 2024
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
United Kingdom
GB
United Kingdom
United Kingdom
Nov 2023 ~ Jan 2024
United States
US
United States
United States
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
Sep 2021 ~ Apr 2023
Jun 2022 ~ Jun 2022
May 2022 ~ Jun 2022
Sep 2021 ~ Apr 2023
Jun 2022 ~ Jun 2022
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Nov 2023 ~ Jan 2024
Jan 2017Aug 2026

Targeted Sectors

Government Agencies and ServicesResearchersJournalistsPro-DemocracyPoliticalEducationDefenseMilitaryUniversityInformation TechnologyConstructionHuman RightsLogisticsEnergyOil and GasUtilities

Recent Indexed Reports

  1. Public
    Mint Sandstorm's Strategic Phishing Tactics and Persistent Threats to Research Organizations
  2. Public
    Iranian APTs Exploit PaperCut Vulnerability in Global Cyber Attacks
  3. Public
    Mint Sandstorm Subgroup Targets US Critical Infrastructure
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.