Actors Insights|Latest update09/05/2025

TA456

Named by ProofpointSuspected state sponsor: Islamic Republic of Iran

The group has been active since at least July 2018.

First Seen:May 2018

Last Seen:Jul 2022

Indexed Reports:1

Public IOCs:5

Cluster: TortoiseshellMitre: CURIUMMisp: Evilnum

also known as:

DeathStalkerTA4563EvilNumJointwormKNOCKOUT SPIDERCURIUM (Microsoft)Crimson Sandstorm (Microsoft)Tortoise ShellG1012 (Mitre)

Targeted Sectors

DefenseAerospace

Recent Indexed Reports

July 28, 2021
Public
TA456's Advanced Espionage Tactics Against Defense Contractors Using LEMPO Malware

Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.