Hazel Sandstorm

Hazel Sandstorm, also known as APT34, OilRig, and EUROPIUM, is a threat actor that has been linked to Iran. This group is known for its sophisticated and persistent cyber attacks on high-profile organizations, using custom-made tools to gain access and systematically exfiltrate data. The cybersecurity industry has tracked various operations of Hazel Sandstorm, which is also associated with another threat actor, Scarred Manticore. The naming conventions for these groups can be complex and inconsistent, but they all refer to entities executing actions with malicious intent. The modus operandi of Hazel Sandstorm includes the use of custom infrastructure, email tunneling for communications, two malware programs similar to previous APT34 code, and domain-naming schemes that mirror those used in past operations. These hallmarks were evident in a recent attack, indicating the involvement of Hazel Sandstorm. The group's attacks are not only technologically advanced but also strategically targeted, focusing on nations and organizations of interest. Previous attacks by Hazel Sandstorm have targeted countries such as Jordan, Lebanon, and Pakistan, demonstrating the group's regional focus. This information comes from an analysis by Check Point's research group, a leading cybersecurity firm. Their findings highlight the significant threat posed by Hazel Sandstorm and underline the importance of robust cybersecurity measures to protect against such sophisticated and persistent threat actors.