Crimson Sandstorm

Crimson Sandstorm is Microsoft's designation for the Iranian threat cluster known as Imperial Kitten and Tortoiseshell, linked to the IRGC. The group focuses on espionage operations against defense, maritime, transportation, and technology sector organizations across the Middle East and beyond. Microsoft uses this name within its Sandstorm naming family for Iranian state actors, reflecting the cluster's sustained operational focus on strategic intelligence collection consistent with IRGC requirements.