Storm-0784

Storm-0784 is Microsoft's tracking designation for an Iranian-linked threat actor active since at least early 2026. The Storm prefix in Microsoft's naming taxonomy indicates an assessed or confirmed nation-state nexus; the 0784 identifier places this cluster within the unclassified staging range used before sufficient evidence is available for a permanent named attribution. Storm-0784 activity has been observed in the context of Iranian state cyber operations targeting organizations of interest to IRGC or MOIS intelligence priorities, though specific tooling, targeting, and definitive organizational attribution have not been fully detailed in public reporting at this stage.