Cotton Sandstorm Cluster

Cotton Sandstorm is an Iranian state-sponsored threat cluster linked to the Islamic Revolutionary Guard Corps (IRGC) and assessed to conduct both cyber-enabled influence operations and destructive cyberattacks. The group is primarily known for hack-and-leak campaigns and online influence activity targeting Israel, the United States, and other Western countries, with a marked increase in operations following the October 2023 Hamas-Israel conflict.

Targets and Goals

Cotton Sandstorm's operations combine two distinct but complementary goals: disrupting critical services through cyberattacks, and amplifying the psychological and reputational impact of those attacks through coordinated influence operations. Targets include Israeli infrastructure, US critical infrastructure, and media ecosystems across the West. The group operates multiple online personas and fake news outlets to spread narratives aligned with Iranian state interests.

Tooling and Tactics

The cluster is known for defacing websites, conducting distributed denial-of-service (DDoS) attacks, and deploying wiper malware under hacktivist personas to create deniability. Operations are typically followed by public claims on Telegram channels and social media to maximize perceived impact. Emennet Pasargad — the Iranian company sanctioned by the US Treasury — has been formally linked to this cluster's operations, providing a direct line to IRGC command.

Aliases

Cotton Sandstorm is tracked as Haywire Kitten by CrowdStrike, and its affiliated company Emennet Pasargad has been sanctioned by the US government. The cluster also operates under the public persona Aria Sepehr Ayandehsazan (ASA) for some influence operations, and used the MARNANBRIDGE persona in hack-and-leak campaigns. Microsoft tracks the same activity under the Cotton Sandstorm designation.