Mint Sandstorm

Mint Sandstorm, an Advanced Persistent Threat (APT) group linked to Iran's Islamic Revolutionary Guard Corps (IRGC), has been identified as a significant cybersecurity threat. The group has demonstrated its capability to rapidly weaponize N-day vulnerabilities in common enterprise applications and conduct highly targeted phishing campaigns. Mint Sandstorm's operators are characterized by their patience and high-level social engineering skills, enabling them to execute attacks that often lack the typical hallmarks of phishing emails, making detection more challenging. The group has targeted various individuals and organizations, including journalists, researchers, professors, and other experts covering security and policy topics of interest to the Iranian government. In June, the Trump campaign cited an incident involving Mint Sandstorm where a spear-phishing email was sent to a high-ranking campaign official from a compromised account. This attack was part of a larger trend of activity targeting U.S. critical infrastructure. In another notable case, the group attempted to log into an account belonging to a former presidential candidate and sent a spear-phishing email to a senior advisor's compromised email account. These incidents highlight the group's focus on high-value targets and its ability to infiltrate trusted communication channels. Microsoft has recommended specific mitigations to reduce the impact of activities associated with recent Mint Sandstorm campaigns. A typical tactic used by the group involves dropping a file in a specific location on the target's computer system. Mitigation strategies should therefore include monitoring for and addressing such suspicious activities. Furthermore, the group is known to deliver a malicious tool called MischiefTut through tailored phishing campaigns. Therefore, increased awareness and defensive measures against such phishing attempts are crucial in preventing successful attacks by Mint Sandstorm.