Threat Actor
Gray Sandstorm
- First Reported
- Apr 6, 2026
- Latest Reported
- Apr 7, 2026
Reported Context (2)
- Check Point assessed that the password-spraying campaign had similarities to Gray Sandstorm activity, including use of red-team tools via Tor exit nodes. The article says Gray Sandstorm was formerly known as DEV-0343. Suspected Iran-Linked Campaign Targets 300+ Israeli Microsoft 365 Organizations
- Check Point Research assessed with moderate confidence that the campaign aligned with Iranian interests and shared similarities with Gray Sandstorm; the article does not confirm the group conducted the activity. Iran-Linked Password-Spraying Campaign Targeted Municipalities in Israel and the UAE
Malware (2)
People (1)
Threat Actors (6)
MITRE ATT&CK (8)
Vendors (5)
Products (3)
Tools (3)
Industries (6)
Countries (7)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.