DEV-0861

DEV-0861 is Microsoft's temporary staging designation for the Iranian MOIS-linked threat cluster later formally named Storm-0861, aligned with the Scarred Manticore and UNC1860 tracking identities. Microsoft used the DEV prefix as an early-stage identifier before sufficient attribution evidence was gathered for a permanent name. Activity tracked under DEV-0861 covers the cluster's initial documented operations in 2022, involving exploitation of internet-facing systems to establish persistent access in government and telecommunications targets across the Middle East, consistent with the broader Scarred Manticore cluster's MOIS-attributed espionage and access-brokering mission.