Actors Insights|Latest update08/01/2025

Mercury

Named by MicrosoftSuspected state sponsor: Islamic Republic of Iran
This threat actor's name is changed to Mango Sandstorm
First Seen:Sep 2020
Last Seen:Apr 2023
Indexed Reports:3
Public IOCs:49
Cluster: MuddyWaterMitre: MuddyWaterMisp: MuddyWater
also known as:
ATK51 (Thales)Boggy SerpensCOBALT ULSTER (SecureWorks)Earth Vetala (Trend Micro)G0069 (Mitre)Mango Sandstorm (Microsoft)MuddyWater (Palo Alto)Seedworm (Symantec)Static Kitten (CrowdStrike)TA450 (Proofpoint)TEMP.Zagros (Mandiant)

Targeted Regions

Israel
IL
Israel
Israel
Jul 2022 ~ Aug 2022
Middle East
ME
Middle East
Middle East
Sep 2020 ~ Oct 2020
Sep 2020 ~ Oct 2020
Jan 2020Oct 2025

Recent Indexed Reports

  1. Public
    MERCURY and DEV-1084's Destructive Cyber Operations Against Cloud and On-Premises Environments
  2. Public
    MERCURY Turns to SysAid Applications for Targeted Cyberattacks in Israel

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.