Smoke Sandstorm

Smoke Sandstorm, also known as UNC1549 and Tortoiseshell, is a threat actor believed to be based in Iran. The group was discovered by Google Cloud's Mandiant and has been linked to spear phishing and watering-hole attacks aimed at credential harvesting and malware distribution. Smoke Sandstorm has been noted for its sophisticated tactics, with each cyberattack campaign being customized to the targeted organization, demonstrating a high level of preparation and understanding of the victims' infrastructure. In 2021, Microsoft reported that Smoke Sandstorm had compromised the email accounts of a Bahrain-based IT integrator, likely as a strategic move to gain access to the firm's government clients. This incident highlighted the group's ability to leverage third-party providers for their operations, thereby increasing their reach and potential impact. Similar techniques have been observed among other Iranian groups, indicating a shared modus operandi within this geographical region. The group's activities are not limited to the Middle East, however. UNC1549 has targeted aerospace and defense firms in Israel, the United Arab Emirates, and other countries across the wider Middle East region. These operations underline the strategic interests of the group and suggest a focus on sectors of significant national security importance. As such, the activities of Smoke Sandstorm pose a substantial threat to both corporate and governmental entities globally.