Mercury

Mercury is Microsoft's legacy designation for the Iranian MOIS-linked threat cluster formally renamed Mango Sandstorm in 2023. Active since at least 2017, Mercury targeted government and telecommunications organizations across the Middle East using spear phishing and custom PowerShell implants. Microsoft retired the Mercury name as part of its updated threat actor naming taxonomy, replacing it with Mango Sandstorm. All Mercury reporting is now consolidated under the Mango Sandstorm designation, which covers the same MOIS-attributed MuddyWater cluster.