Storm-0861

Storm-0861 is Microsoft's formal designation for the Iranian MOIS-linked threat cluster known as Scarred Manticore and UNC1860. Microsoft tracked this cluster's involvement in high-profile destructive operations in the Middle East, including providing initial access that enabled subsequent wiper attacks against government targets in the region. Storm-0861 operations reflect the cluster's role as both an independent espionage actor and an access enabler for other Iranian state cyber operators, consistent with Mandiant's UNC1860 assessment of the group's function within Iran's broader offensive cyber infrastructure.