Lemon Sandstorm

Lemon Sandstorm is Microsoft's current designation for the Iranian IRGC-linked threat cluster known as Pioneer Kitten and Fox Kitten. Active since at least 2023 in Microsoft's tracking, the group conducts network intrusion operations exploiting VPN and remote access vulnerabilities, and collaborates with ransomware affiliate groups by selling established network access. Microsoft's Sandstorm naming convention places Lemon Sandstorm within the IRGC-attributed family of Iranian actors, replacing the earlier RUBIDIUM designation. The cluster's dual espionage and access-brokering mission reflects the Iranian state's use of cyber operations for both intelligence collection and revenue generation.