BOHRIUM

BOHRIUM is Microsoft's legacy designation for an Iranian-linked threat actor that conducted spear phishing campaigns targeting technology, education, and government sector organizations. The group was publicly disrupted in June 2022 when Microsoft's Digital Crimes Unit seized 41 domains used by the actors, following a court order. BOHRIUM operations focused on credential harvesting through fake job lures, with victims primarily in India, the United States, and the Middle East. The group was subsequently renamed Smoke Sandstorm as part of Microsoft's 2023 threat actor taxonomy update, reflecting the cluster's assessed IRGC attribution and alignment with Imperial Kitten and UNC1549 tracking.