Storm-861
Named by MicrosoftSuspected state sponsor: Islamic Republic of IranStorm-861 is an alternative Microsoft tracking label for a subset of Scarred Manticore activity, used in some reporting during 2023-2024 to track the cluster's operations against Israeli and Middle Eastern targets. The designation covers the same Iranian MOIS-linked actor tracked as Scarred Manticore by Check Point and Sygnia, and UNC1860 by Mandiant. Storm-861 activity in this period involved the group's passive IIS implant infrastructure and web shell deployment against government and telecommunications targets, consistent with the cluster's established access-brokering and espionage mission.
Disclaimer: We are working on indexing and analyzing relevant data and this process is not fully completed yet. Therefore, displayed details and statistics may will change in the future.