Actors Insights|Latest update29/07/2026

Hazel Sandstorm

Named by MicrosoftSuspected state sponsor: Islamic Republic of Iran

Hazel Sandstorm is Microsoft's current designation for the Iranian MOIS-linked threat cluster known as OilRig and APT34, replacing the earlier EUROPIUM name. Active since at least 2017, the cluster targets government, energy, and financial organizations across the Middle East with a broad custom malware toolkit and DNS-based command and control infrastructure. Microsoft's Sandstorm naming convention places Hazel Sandstorm within the MOIS-attributed family of Iranian actors, distinguishing it from IRGC-linked Sandstorm designations used for other Iranian clusters.

This threat actor previously was known as EUROPIUM
First Seen:Sep 2017
Last Seen:Jun 2025
Indexed Reports:1
Public IOCs:0
Cluster: OilRigMitre: OilRigMisp: OilRig
also known as:
Twisted Kitten (CrowdStrike)COBALT GYPSY (SecureWorks)Crambus (Symantec)Helix Kitten (CrowdStrike)APT 34IRN2 (Area 1)ATK40 (Thales)G0049 (Mitre)Evasive SerpensHazel Sandstorm (Microsoft)EUROPIUM (Microsoft)TA452 (Proofpoint)Earth Simnavaz (Trend Micro)OilRig (Palo Alto)ITG13 (IBM)

Targeted Regions

Albania
AL
Albania
Albania
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Israel
IL
Israel
Israel
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Jordan
JO
Jordan
Jordan
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Kuwait
KW
Kuwait
Kuwait
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Saudi Arabia
SA
Saudi Arabia
Saudi Arabia
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Turkey
TR
Turkey
Turkey
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
United Arab Emirates
AE
United Arab Emirates
United Arab Emirates
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Apr 2020 ~ Sep 2022
Jan 2020Sep 2026

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.