Mango Sandstorm
The provided content only contains the actor name “mango_sandstorm” and does not include any high-confidence, actor-specific details (e.g., attribution, aliases, targeting, TTPs, tooling, infrastructure, or campaigns) directly tied to this name. The content instead discusses multiple Iran-nexus threat groups (e.g., APT42/Charming Kitten, Pink Sandstorm, MuddyWater, APT34, etc.) and broader Iran-related cyber activity, but does not state that “mango_sandstorm” is an alias of, subgroup of, or otherwise associated with any of those entities. As a result, no detailed description can be produced for “mango_sandstorm” based solely on the supplied content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
MuddyWater is an Iranian APT group known for cyber-espionage and delivering custom malware such as UDPGangster.
TEMP.Zagros used Gemini LLM for malware development and data analysis, employing social engineering to bypass AI safeguards and obtain technical assistance for custom malware projects.
MuddyWater is engaged in espionage campaigns, expanding its toolkit with the Phoenix v4 backdoor delivered via FakeUpdate, abusing remote management tools, deploying a custom Chromium credential stealer, and using NordVPN for phishing operations. They are also using COM-based persistence and maintaining live command and control infrastructure.
MuddyWater is an Iranian state-sponsored threat actor known for conducting espionage and disruptive cyber operations, primarily targeting government entities and critical infrastructure in the Middle East, North Africa, and occasionally Europe. The group is linked to Iran's Ministry of Intelligence and Security (MOIS) and has been responsible for high-profile attacks, including the disruption of Albanian government services.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.