Actors Insights|Latest update26/07/2024

Phosphorus

Named by MicrosoftSuspected state sponsor: Islamic Republic of Iran
This threat actor's name is changed to Mint Sandstorm
First Seen:Sep 2020
Last Seen:Jan 2024
Indexed Reports:7
Public IOCs:135
Cluster: Charming KittenMitre: Magic HoundMisp: APT35
also known as:
APT35 (Mandiant)APT42 (Mandiant)COBALT ILLUSION (SecureWorks)Charming Kitten (CrowdStrike)COBALT MIRAGE (SecureWorks)G0059 (Mitre)ITG18 (IBM)Magic Hound (Palo Alto)Mint Sandstorm (Microsoft)Newscaster Team (Symantec)TA453 (Proofpoint)TunnelVision (SentinelOne)

Most Common Tactics

Targeted Regions

Belgium
BE
Belgium
Belgium
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Europe
EU
Europe
Europe
Sep 2020 ~ Oct 2020
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
France
FR
France
France
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Israel
IL
Israel
Israel
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Middle East
ME
Middle East
Middle East
Sep 2020 ~ Oct 2020
Palestine
PS
Palestine
Palestine
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Sep 2020 ~ Oct 2020
United Kingdom
GB
United Kingdom
United Kingdom
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
United States
US
United States
United States
Sep 2020 ~ Oct 2020
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
May 2022 ~ Jun 2022
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Sep 2021 ~ Apr 2023
Nov 2023 ~ Jan 2024
Nov 2023 ~ Jan 2024
Jan 2020Nov 2024

Targeted Sectors

JournalistsPro-DemocracyPoliticalResearchersUniversityConstructionHuman RightsLogisticsEnergyOil and GasUtilities

Recent Indexed Reports

  1. Public
    Mint Sandstorm Subgroup Targets US Critical Infrastructure
  2. Public
    Stealth in the System: PHOSPHORUS Exploits Exchange Server in Infrastructure Sector Attack
  3. Public
    PowerLess Backdoor: Analyzing the Phosphorus Group's Cyber Espionage Tool
see more

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.