Cotton Sandstorm
Cotton Sandstorm is classified as state-sponsored.
- Suspected state sponsor
- Iran
- Also known as
- 5
Cotton Sandstorm is an Iranian threat actor involved in hack-and-leak operations. They have targeted various organizations, including the French satirical magazine Charlie Hebdo, where they obtained and leaked personal information of over 200,000 customers. The group has been linked to the Iranian government and has been sanctioned by the US Treasury
The group is suspected of operating with the support of Iran.
Also known as: Emennet Pasargad, Holy Souls, MARNANBRIDGE, NEPTUNIUM, HAYWIRE KITTEN
Published reports on this actor:
- https://blog.sekoia.io/iran-cyber-threat-overview/
- https://blogs.microsoft.com/on-the-issues/2023/02/03/dtac-charlie-hebdo-hack-iran-neptunium/
- https://www.ic3.gov/Media/News/2022/220126.pdf
Source: MISP Galaxy, Malpedia.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainThreat Intelligence
Track ransomware groups, victim posts and indicators of compromise, and see the records that match your own assets.