Actors Insights|Latest update20/02/2025

Mercury

Named by MicrosoftSuspected state sponsor: Islamic Republic of Iran

This threat actor's name is changed to Mango Sandstorm

First Seen:Sep 2020

Last Seen:Apr 2023

Indexed Reports:3

Public IOCs:49

Cluster: MuddyWaterMitre: MuddyWaterMisp: MuddyWater

also known as:

ATK51 (Thales)Boggy SerpensCOBALT ULSTER (SecureWorks)Earth Vetala (Trend Micro)G0069 (Mitre)Mango Sandstorm (Microsoft)MuddyWater (Palo Alto)Seedworm (Symantec)Static Kitten (CrowdStrike)TA450 (Proofpoint)TEMP.Zagros (Mandiant)

Targeted Regions

Israel

Israel

Jul 2022 ~ Aug 2022

Middle East

Middle East

Sep 2020 ~ Oct 2020

Sep 2020 ~ Oct 2020

Jan 2020Oct 2025

Recent Indexed Reports

April 07, 2023
Public
MERCURY and DEV-1084's Destructive Cyber Operations Against Cloud and On-Premises Environments
August 25, 2022
Public
MERCURY Turns to SysAid Applications for Targeted Cyberattacks in Israel
October 06, 2020
Public
Iranian APT MERCURY Exploits Zerologon in Persistent Cyber Campaigns

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.