Gray Sandstorm

Gray Sandstorm is a Microsoft tracking name for a subset of activity attributed to the Iranian APT33 cluster. The designation follows Microsoft's Sandstorm naming convention for Iranian state-sponsored actors and reflects more recent operational activity observed in early 2026. The group shares the core tradecraft of the broader APT33 cluster — including password spray campaigns and intelligence collection targeting defense, aerospace, and energy sectors — and is assessed to operate in support of Iranian state interests alongside the wider Peach Sandstorm and HOLMIUM tracking identities.