Cotton Sandstorm

Cotton Sandstorm is an Iranian state-sponsored threat cluster linked to the IRGC and known for combining cyberattacks with influence operations. Active since at least 2023, the group conducts website defacements, DDoS attacks, and hack-and-leak campaigns primarily targeting Israeli and Western organizations, with operations intensifying following the October 2023 Hamas-Israel conflict. The US Treasury sanctioned the affiliated Iranian company Emennet Pasargad for its role in these operations. Microsoft tracks this cluster as Cotton Sandstorm; CrowdStrike uses the name Haywire Kitten.