Smoke Sandstorm

Smoke Sandstorm is a Microsoft tracking designation for recent Imperial Kitten activity, reflecting updated operational patterns observed from 2023 onward. The designation follows Microsoft's Sandstorm naming convention for IRGC-linked Iranian actors. Smoke Sandstorm activity includes job-recruitment phishing campaigns targeting aerospace and defense professionals, consistent with the broader Imperial Kitten cluster's long-running focus on defense sector intelligence collection. The name aligns with Proofpoint's TA455 tracking for the same activity period.