Mint Sandstorm

Mint Sandstorm is Microsoft's current name for the Iranian state-sponsored threat cluster previously tracked as Phosphorus and widely known as Charming Kitten and APT35. The cluster is associated with the IRGC and comprises multiple subgroups with distinct operational focuses. Microsoft has documented one technically sophisticated subgroup that rapidly weaponizes N-day vulnerabilities to target critical infrastructure including seaports, energy companies, and transit systems, as well as high-value individuals in the defense and government sectors. A second subgroup focuses on credential phishing against journalists, activists, and policy researchers. Activity overlaps with APT35, APT42, and TA453.