Mint Sandstorm

Mint Sandstorm, an Advanced Persistent Threat (APT) group linked to Iran's Islamic Revolutionary Guard Corps (IRGC), has been identified as a significant cyber threat actor. This group is known for its highly skilled operators and sophisticated social engineering techniques, often lacking the typical hallmarks of phishing emails, making them harder to detect. They have been found to rapidly weaponize N-day vulnerabilities in common enterprise applications and conduct targeted phishing campaigns to gain access to environments of interest. Notably, in June, they targeted US critical infrastructure by sending a spear-phishing email from a compromised account to a high-ranking official of the Trump campaign. In recent years, Mint Sandstorm has refined their tradecraft and increased their activity. They have targeted various high-profile individuals and organizations, including journalists, researchers, professors, and other experts covering security and policy topics of interest to the Iranian government. In one notable campaign, they used a tailored phishing scam related to the Hamas-Israel conflict to target universities. The group also tends to drop malicious files in specific locations on compromised systems, such as C:\\Users\\[REDACTED] \\AppData\\Local\\Microsoft\\Media Player\\MediaPl.dll, to maintain persistence and evade detection. To mitigate the threats posed by Mint Sandstorm, Microsoft has recommended several measures. These include being vigilant against phishing attempts, regularly updating and patching software to protect against the exploitation of known vulnerabilities, and maintaining robust cybersecurity protocols. Despite these recommendations, Mint Sandstorm continues to evolve its tooling and techniques to better persist in compromised environments and evade detection, demonstrating the ongoing threat it poses to cybersecurity.