{"id":127280,"date":"2023-04-18T08:00:00","date_gmt":"2023-04-18T15:00:00","guid":{"rendered":""},"modified":"2025-06-24T03:56:06","modified_gmt":"2025-06-24T10:56:06","slug":"nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/04\/18\/nation-state-threat-actor-mint-sandstorm-refines-tradecraft-to-attack-high-value-targets\/","title":{"rendered":"Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets"},"content":{"rendered":"\n

Over the past several months, Microsoft has observed a mature subgroup of Mint Sandstorm, an Iranian nation-state actor previously tracked as PHOSPHORUS, refining its tactics, techniques, and procedures (TTPs). Specifically, this subset has rapidly weaponized N-day vulnerabilities in common enterprise applications and conducted highly-targeted phishing campaigns to quickly and successfully access environments of interest. This Mint Sandstorm subgroup has also continued to develop and use custom tooling in selected targets, notably organizations in the energy and transportation sectors. Given this subgroup\u2019s capabilities, the profile of past targets, and the potential for cascading effects, Microsoft is publishing details on known tradecraft alongside corresponding detections and mitigations to help organizations protect against this and similar threats.<\/p>\n\n\n\n

Who is Mint Sandstorm?<\/h2>\n\n\n\n

Mint Sandstorm is Microsoft\u2019s new name for PHOSPHORUS, an Iranian nation-state actor. This new name is part of the new threat actor naming taxonomy<\/a> we announced today, designed to keep pace with the evolving and growing threat landscape.<\/p>\n\n\n\n

Mint Sandstorm is known<\/a> to pursue targets in both the private and public sectors, including<\/a> political dissidents, activist leaders, the Defense Industrial Base (DIB), journalists, and employees from multiple government agencies, including individuals protesting oppressive regimes in the Middle East.  Activity Microsoft tracks as part of the larger Mint Sandstorm group overlaps with public reporting on groups known as APT35, APT42, Charming Kitten, and TA453.<\/p>\n\n\n\n

Mint Sandstorm is a composite name used to describe several subgroups of activity with ties to the same organizational structure. Microsoft assesses that Mint Sandstorm is associated with an intelligence arm of Iran\u2019s military,<\/a> the Islamic Revolutionary Guard Corps (IRGC), an assessment that has been corroborated by multiple credible sources including Mandiant<\/a>, Proofpoint<\/a>, and SecureWorks<\/a>.  In 2022, the US Department of Treasury sanctioned<\/a> elements of Mint Sandstorm for past cyberattacks citing sponsorship from the IRGC.<\/p>\n\n\n\n

Today, Microsoft is reporting on a distinct Mint Sandstorm subgroup that specializes in hacking into and stealing sensitive information from high-value targets. This Mint Sandstorm subgroup is technically and operationally mature, capable of developing bespoke tooling and quickly weaponizing N-day vulnerabilities, and has demonstrated agility in its operational focus, which appears to align with Iran\u2019s  national priorities.<\/p>\n\n\n\n

Microsoft Threat Intelligence consistently tracks threat actor activity, including Mint Sandstorm and its subgroups, and works across Microsoft Security products and services to build detections into our products that improve protection for customers. As with any observed nation state actor activity, Microsoft directly notifies customers that have been targeted or compromised, providing them with the information they need to secure their accounts. Microsoft is sharing details on these operations to raise awareness on the risks associated with their activity and to empower organizations to harden their attack surfaces against tradecraft commonly used by this Mint Sandstorm subgroup.<\/p>\n\n\n\n

Recent operations<\/h2>\n\n\n\n

From late 2021 to mid-2022, this Mint Sandstorm subgroup moved from reconnaissance to direct targeting of US critical infrastructure including seaports, energy companies, transit systems, and a major US utility and gas entity potentially in support of retaliatory destructive cyberattacks. This targeting was likely in response to Iran\u2019s attribution of cyberattacks that halted maritime traffic at a major Iranian seaport<\/a> in May 2020, delayed Iranian trains<\/a> in July 2021, and crashed gas station payment systems<\/a> throughout Iran in late 2021. Of note, a senior cybersecurity-focused IRGC official and others close to the Iranian Supreme Leader pinned the attack affecting gas station payment systems<\/a> on Israel and the United States.<\/p>\n\n\n\n

This targeting also coincided with a broader increase in the pace and the scope of cyberattacks attributed to Iranian threat actors, including another Mint Sandstorm subgroup, that Microsoft observed beginning in September 2021. The increased aggression of Iranian threat actors appeared to correlate with other moves by the Iranian regime under a new national security apparatus, suggesting<\/a> such groups are less bounded in their operations.  Given the hardline consensus among policymakers in Tehran and sanctions previously levied on Iran\u2019s security organizations, Mint Sandstorm subgroups may be less constrained in carrying out malicious cyber activity. <\/em><\/strong><\/p>\n\n\n\n

Mint Sandstorm tradecraft<\/h2>\n\n\n\n

Microsoft has observed multiple attack chains and various tools in compromises involving this Mint Sandstorm subgroup. The TTPs detailed below are a sampling of new or otherwise notable tradecraft used by this actor.<\/p>\n\n\n\n

Rapid adoption of publicly disclosed POCs for initial access and persistence<\/h3>\n\n\n\n

Microsoft has increasingly observed this Mint Sandstorm subgroup adopting publicly disclosed proof-of-concept (POC) code shortly after it is released to exploit vulnerabilities in internet-facing applications. Until 2023, this subgroup had been slow to adopt exploits for recently-disclosed vulnerabilities with publicly reported POCs, often taking several weeks to successfully weaponize exploits for vulnerabilities like Proxyshell and Log4Shell. However, beginning in early 2023, Microsoft observed a notable decrease in the time required for this subgroup to adopt and incorporate public POCs. For example, Mint Sandstorm began exploiting CVE-2022-47966<\/a> in Zoho ManageEngine on January 19, 2023, the same day the POC became public. They later exploited CVE-2022-47986<\/a> in Aspera Faspex within five days of the POC being made public on February 2, 2023.<\/p>\n\n\n\n

While this subgroup has demonstrated their ability to rapidly incorporate new public POCs into their playbooks, Microsoft has also observed that Mint Sandstorm continues to use older vulnerabilities, especially Log4Shell, to compromise unpatched devices. As this activity is typically opportunistic and indiscriminate, Microsoft recommends that organizations regularly patch vulnerabilities with publicly available POCs, regardless of how long the POC has been available.<\/strong><\/strong><\/p>\n\n\n\n

After gaining initial access to an organization by exploiting a vulnerability with a public POC, this Mint Sandstorm subgroup deploys a custom PowerShell script designed for discovery. In some cases, the subgroup does not act on the information they collect, possibly because they assess that a victim does not meet any targeting requirements or because the subgroup wishes to wait and focus on more valuable targets. In cases where Mint Sandstorm operators continue their pursuit of a given target, Microsoft typically observes one of two possible attack chains.<\/p>\n\n\n\n

\"Diagram
Figure 1. The two attack chains used by the Mint Sandstorm subgroup<\/em><\/figcaption><\/figure>\n\n\n\n