DEV-1084

DEV-1084 is Microsoft's temporary designation for a MuddyWater subgroup responsible for the March 2023 destructive attack against Israeli organizations using DarkBit ransomware. Microsoft later formally named this subgroup Storm-1084. The attack followed an intrusion attributed to Mango Sandstorm (MuddyWater), in which DEV-1084 leveraged access established by the parent cluster to deploy the DarkBit payload — effectively combining MuddyWater's espionage access with a destructive wiper-ransomware capability, resulting in significant disruption to affected Israeli organizations.