Mango Sandstorm

Mango Sandstorm, also known as MuddyWater or Mercury, is a threat actor group linked to Iran's Ministry of Intelligence and Security (MOIS) by the Israeli government. The group has been identified as being involved in several cyber-attacks, utilizing various tactics to gain initial access to targeted infrastructures. In one notable incident, Mango Sandstorm accessed several privileged on-prem accounts, which then facilitated lateral movement within the compromised systems. This highlights the security challenges posed by hybrid IT environments, an issue that is increasingly coming under scrutiny. The cybersecurity industry has observed the activities of Mango Sandstorm alongside another Iranian state-sponsored threat actor group, Mint Sandstorm (also known as Phosphorus or APT35), believed to be associated with the Islamic Revolutionary Guard Corps (IRGC). Both groups have been seen exploiting the vulnerability CVE-2023-27350. In a recent attack, Mango Sandstorm used privileged account credentials to target a system hosting the Azure AD Connect agent, underscoring their ability to exploit weaknesses in complex IT systems. Several cybersecurity entities, including Microsoft and Symantec Threat Hunter Team, part of Broadcom, are actively tracking the activities of these groups. The latter organization is monitoring Mango Sandstorm's activity under various names, including Seedworm, Boggy Serpens, Cobalt Ulster, Earth Vetala, ITG17, Static Kitten, TEMP.Zagros, and Yellow Nix. Given the sophisticated tactics employed by these groups and their links to national security entities, they represent significant threats to global cybersecurity.