Mango Sandstorm / Mercury

Overview

Mango Sandstorm — the current Microsoft designation for the group most widely known as MuddyWater — is formally attributed to Iran's Ministry of Intelligence and Security (MOIS) as a subordinate element conducting cyber espionage on MOIS's behalf. The attribution was made public by US Cyber Command and CISA in January 2022, confirming what researchers had assessed based on targeting alignment and Iranian IP address exposure since the group's first appearance in 2017. The group's primary mission is long-term persistent access for intelligence collection — it does not conduct financially motivated attacks, and its destructive operations are coordinated through partner threat actors rather than executed with its own tooling directly.

The group's defining characteristic through its first several years was an evolving PowerShell-based toolkit — the POWERSTATS backdoor and subsequent custom PowerShell loaders that changed incrementally with each public exposure. This approach, while adaptive, generated a consistent behavioral signature that defenders learned to detect. Beginning in 2021 and accelerating significantly after October 2023, the group shifted its primary initial access strategy toward abusing legitimate remote monitoring and management (RMM) tools. By deploying commercially licensed software like Atera Agent, SimpleHelp, ScreenConnect, RemoteUtilities, and N-able as their foothold mechanism, the group's C2 traffic becomes nearly indistinguishable from legitimate IT management traffic — a significant detection evasion improvement over custom PowerShell loaders.

The October 2023 Hamas attack on Israel and the subsequent Israeli military response triggered a notable escalation in Mango Sandstorm activity. HarfangLab documented a surge in Atera Agent deployment campaigns beginning immediately after October 7, 2023, targeting Israeli organizations across multiple industries. This post-October 2023 wave extended to businesses in India, Algeria, Turkey, Italy, and Egypt — consistent with the group's broad geographic scope while intensifying Israeli targeting.

Simultaneously, the group continued investing in custom C2 framework development. Deep Instinct documented DarkBeatC2 in April 2024 — the latest in a succession of custom frameworks including MuddyC3, PhonyC2, MuddyC2Go, and SimpleHarm. Each framework uses PowerShell for C2 communication over HTTPS with TLS 1.2, polling C2 servers in a loop with configurable sleep intervals. The BugSleep implant, documented in mid-2024, and MuddyViper, documented by ESET between September 2024 and March 2025 against Israeli organizations, extended the group's custom malware family further.

A particularly significant intelligence finding came from Amazon Threat Intelligence in November 2024: Mango Sandstorm operators were documented having accessed compromised servers containing live CCTV feeds prior to attacks in Israel and the Red Sea. This correlation between pre-positioning on surveillance infrastructure and subsequent kinetic military operations — while not establishing a direct causal link — raised documented concerns about MOIS providing tactical intelligence support to Iranian military and proxy operations. In early 2026, FBI and CISA reported Mango Sandstorm-linked activity backdooring US critical infrastructure including a bank, an airport, and a non-profit, using the Dindoor backdoor and DarkBeatC2 implants.

Target Profile

Mango Sandstorm has one of the broadest documented target geographies of any Iranian APT, reflecting MOIS's global intelligence collection mandate across adversaries, partners, and neutral parties alike.

• Middle East — Government, Telecom, Energy (primary): Gulf Cooperation Council member states are heavily targeted, with documented intrusions across UAE government ministries and telecommunications, Saudi Arabian energy and government agencies, Kuwaiti government networks and banking, Bahraini telecommunications, and Qatari and Omani critical infrastructure. Israel has been an intensive focus since at least 2023, with campaigns targeting government agencies, defense sector, IT companies, airlines, pharma, and manufacturing. Turkey, Jordan, Iraq, and Afghanistan have also appeared repeatedly across multi-year campaign documentation.
• Asia — India, Pakistan, Azerbaijan: Government entities and critical infrastructure across South Asia and the Caucasus. India has appeared in multiple campaign victim lists including the October 2023–2024 Atera Agent wave. Pakistan has been targeted in coordination with campaigns against neighboring countries with overlapping geopolitical interest for MOIS.
• Africa: Algeria was identified among targets in the October 2023 Atera wave. Broader African targeting reflects MOIS intelligence requirements across the African Union states where Iranian diplomatic engagement and economic interests have expanded.
• Europe — NATO States: Belgium, Italy, and other European targets have appeared in documented campaigns. European targeting primarily reflects espionage against NATO-member organizations connected to Middle East policy and sanctions enforcement.
• North America — US Critical Infrastructure: FBI and CISA confirmed Mango Sandstorm-linked activity backdooring US critical infrastructure in early 2026 — a bank, an airport, and a non-profit — using Dindoor and DarkBeatC2. Earlier US targeting documented by MITRE ATT&CK spans government, defense, and oil and gas organizations.
• Sector priorities across all geographies: Telecommunications (providing communications intelligence), government (diplomatic and policy intelligence), defense and military, oil and natural gas, and critical infrastructure. The group's consistent sector focus across all geographies reflects stable MOIS collection priorities rather than opportunistic targeting.

Tactics, Techniques & Procedures

Mango Sandstorm has undergone the most significant TTP evolution of any Iranian APT in the 2023–2025 period. The shift from PowerShell backdoors to RMM tool abuse represents a deliberate evasion adaptation rather than a capability gap — the group continues developing custom malware while adding legitimate tool abuse as a first-stage layer.

mitre id	technique	description
T1566.001/002	Spear-Phishing — RMM Delivery	The primary initial access vector since 2021, now dominant. Spearphishing emails deliver links to file-sharing services (Egnyte, Onehub, Sync, TeraBox) hosting ZIP archives containing RMM installer packages. A notable 2024 innovation: PDF attachments containing malicious embedded links replacing direct email links — documented by Proofpoint in March 2024 against Israeli employees of multinational organizations using salary-related lures. Some messages are sent from compromised .IL (Israeli) business email accounts to maximize credibility. Social engineering themes include flight status tools, regional development programs, cybersecurity webinars, and online courses.
T1219	Remote Access Tools — RMM Software Abuse	The defining TTP shift of the 2023–2025 period. Rather than deploying custom backdoors as first-stage tools, Mango Sandstorm deploys commercially licensed RMM products — Atera Agent, SimpleHelp, ScreenConnect, RemoteUtilities, Syncro, N-able — as their initial foothold. These tools have legitimate certificates, are recognized by endpoint security products as trusted software, communicate over standard HTTPS, and generate traffic indistinguishable from legitimate IT management activity. The group has tested multiple RMM products and currently favors Atera. When RMM tool detection rates increase following vendor disclosure, the group switches to alternative products or reverts to custom implants.
T1190	Exploit Public-Facing Application	Vulnerability exploitation complements the spearphishing model. Documented exploitation includes Log4Shell (CVE-2021-44228) in SysAid servers, PaperCut print management (CVE-2023-27350), and internet-facing application vulnerabilities in general. The MERCURY + DEV-1084 destructive campaign documented by Microsoft in April 2023 used Log4j exploitation as a probable entry vector into hybrid Azure/on-premises environments.
T1059.001	PowerShell — Custom C2 Frameworks	Mango Sandstorm has developed a succession of custom C2 frameworks all using PowerShell as their execution layer: MuddyC3, PhonyC2 (June 2023), MuddyC2Go (November 2023, written in Go), DarkBeatC2 (April 2024). Each framework polls a C2 server via PowerShell HTTPS requests (Invoke-WebRequest with TLS 1.2) in a sleep loop, executes received scriptblock content, and writes results back to the C2. DarkBeatC2 specifically uses response content checks for the string "SRT_" to determine sleep duration adjustments. This framework succession reflects continuous development investment despite the simultaneous shift to RMM tool abuse.
T1588.001	BugSleep, MuddyViper, Dindoor — Custom Implants	BugSleep (first documented mid-2024) is a Python-based implant providing system information gathering, persistence, interactive shell, and file upload/download. Phoenix, documented by Group-IB as a lightweight BugSleep variant, added browser credential stealing (Brave, Chrome, Edge, Opera). MuddyViper was deployed by ESET against Israeli organizations between September 2024 and March 2025. Dindoor, a Deno runtime-based backdoor, was used in February 2026 US infrastructure intrusions alongside Fakeset (Python-based, with code-signing certificate lineage to earlier MuddyWater families). Rclone is used for data exfiltration to Wasabi cloud storage, blending with legitimate cloud traffic.
T1003.001	Credential Dumping — LSASS and Browser Credentials	Post-initial-access credential collection proceeds via LSASS memory dumping using standard Windows tools and custom Mimikatz variants. Browser credential harvesting (Chrome, Firefox, Edge, Brave, Opera) is documented in recent BugSleep/Phoenix variants, reflecting expansion beyond Windows credential stores into the browser credential ecosystem that many organizations do not adequately protect. Harvested credentials support lateral movement and account takeover for subsequent spearphishing from compromised legitimate email accounts.
T1485	Destructive Collaboration — DEV-1084 / DarkBit	Microsoft's April 2023 report documented MERCURY providing initial access to DEV-1084 (also known as DarkBit), which then executed destructive wiper attacks against hybrid Azure/on-premises environments — deleting Azure resources, distributing ransomware-like disk wipers on-premises, and operating a fake ransomware payment portal with no actual decryption. The hand-off model mirrors Moses Staff's approach: an espionage-focused group achieving access and passing it to a destruction-focused actor. DEV-1084 uses MERCURY-associated infrastructure including IP address 146.70.106[.]89, MULLVAD VPN, and the C2 domain vatacloud[.]com.

Known Campaigns

Mango Sandstorm's campaign history spans nearly a decade of continuous operation, with the most significant documented activity concentrated from 2022 to early 2026.

Tools & Malware

Mango Sandstorm operates the most diverse and continuously evolving toolchain of any Iranian APT — combining a custom C2 framework succession with legitimate RMM tool abuse and a growing portfolio of custom implants.

• Legitimate RMM Tools (Atera, SimpleHelp, ScreenConnect, RemoteUtilities, N-able, Syncro): The primary first-stage mechanism since 2021. Atera Agent is the current preferred tool following a period of SimpleHelp use in 2023. Installer packages are distributed through phishing delivery chains and, once installed, provide the operators with full remote management capability indistinguishable from legitimate IT administration traffic. The group configures the RMM agents with operator-controlled email addresses or accounts before distributing installer packages.
• DarkBeatC2: The most recent custom C2 framework (documented April 2024), using PowerShell for C2 communication over HTTPS/TLS 1.2 via Invoke-WebRequest. Polls C2 in a loop with 20-second sleep intervals, checks response content for "SRT_" sleep-adjustment strings, converts non-null responses into scriptblock and executes them. Hosted on infrastructure in subnets previously associated with PhonyC2 and MuddyC2Go campaigns.
• PhonyC2 and MuddyC2Go: Prior-generation custom C2 frameworks. PhonyC2 (June 2023) uses a similar PowerShell polling model; MuddyC2Go (November 2023) is written in Go rather than Python/PowerShell, representing a language shift to reduce detection by tools trained on Python or PowerShell malware signatures. Both succeeded SimpleHarm and MuddyC3.
• BugSleep and Phoenix: Python-based implants documented in mid-2024. BugSleep provides system information gathering, persistence, interactive shell, and file upload/download. Phoenix is a lighter-weight variant adding browser credential stealing from Brave, Chrome, Edge, and Opera. Infrastructure hosting Phoenix also serves RMM utilities, indicating a role as a combined credential theft and access maintenance tool.
• MuddyViper: A backdoor deployed against Israeli organizations between September 2024 and March 2025 per ESET research. Details are limited in public reporting but represent a distinct implant family from BugSleep.
• Dindoor (Deno-based) and Fakeset (Python): The most recently documented implant generation (February 2026 US infrastructure campaign). Dindoor is notable for using the Deno runtime — a less common execution environment that reduces detection by tools trained primarily on Python and PowerShell. Fakeset's code-signing certificate lineage directly links it to earlier MuddyWater families (Stagecomp, Darkcomp), providing a strong attribution anchor despite the new malware family designation.
• POWERSTATS and Historical PowerShell Loaders: The foundational tool across 2017–2021 campaigns. A PowerShell-based backdoor providing basic C2 functionality through iterative script updates. Still referenced in attack analysis as the original MuddyWater signature capability, though now superseded by the RMM and custom framework approach.
• Rclone: An open-source cloud sync tool used for data exfiltration, directing collected material to Wasabi cloud storage buckets. By using a legitimate cloud service with a known commercial utility, exfiltration traffic is nearly indistinguishable from authorized cloud backup or sync operations.

Indicators of Compromise

Mango Sandstorm's most current threat indicators reflect the RMM tool abuse model and custom C2 frameworks. Static infrastructure IOCs rotate frequently; behavioral indicators are more durable.

Mitigation & Defense

The RMM tool abuse model fundamentally changes the defensive challenge: standard malware detection is ineffective against signed, commercial software. Defense must shift to authorization-based controls.

• Implement RMM software inventory and unauthorized installation alerting: Maintain an approved list of RMM products authorized for use in your environment. EDR and endpoint management policies should alert — or block — any RMM product installation that was not initiated through an approved change management process. Atera Agent, SimpleHelp, ScreenConnect, and RemoteUtilities appearing on endpoints where they were not previously present should generate immediate security alerts regardless of the legitimacy of the software itself.
• Monitor for RMM network traffic from unexpected endpoints: RMM products generate characteristic outbound traffic to vendor cloud infrastructure. Network monitoring should alert on RMM protocol traffic originating from servers, industrial systems, or other endpoints where IT management tools have no legitimate role. Network segmentation that blocks RMM vendor cloud endpoint connectivity from these segments eliminates this attack vector for those environments.
• Block PDF attachment links at email gateway and train users on the vector: Mango Sandstorm's 2024 shift to PDF attachments with embedded file-sharing links targets users who have been trained not to click links in email bodies but may not apply the same scrutiny to links within PDF attachments. Email security should extract and scan links from PDF attachments with the same rigor as email body links. User awareness training should explicitly address this variant.
• Enable PowerShell Script Block Logging (Event ID 4104): DarkBeatC2 and prior custom C2 frameworks all execute via PowerShell scriptblocks. Script Block Logging captures the actual content of executed PowerShell scripts — including dynamically constructed scriptblocks assembled from C2 responses — and feeds it to SIEM detection rules. This is the single highest-value control for detecting Mango Sandstorm's custom C2 framework generation. Combining with AMSI integration enables real-time detection of malicious scriptblock content before execution completes.
• Monitor Rclone and cloud sync tool execution for exfiltration: Rclone is the documented data exfiltration tool for the Dindoor/Fakeset campaign wave. DLP and endpoint controls should alert on Rclone execution — particularly when launched by processes not associated with authorized backup or sync workflows — and monitor outbound data volumes to Wasabi, Backblaze B2, and other object storage services from endpoints that have no legitimate business use of those services.
• Patch Log4j, PaperCut, and internet-facing application vulnerabilities on an emergency basis: Log4Shell and PaperCut CVE-2023-27350 were both exploited by Mango Sandstorm well after patch availability. Any organization running unpatched versions of applications on CISA's Known Exploited Vulnerabilities catalog — particularly internet-facing — should treat them as active intrusion vectors. Vulnerability management programs that treat exploitation-confirmed CVEs as critical-priority patches within days of disclosure are the appropriate response posture for an organization in this threat group's targeting scope.
• Alert on Deno runtime execution in enterprise environments: Dindoor uses the Deno runtime — a legitimate JavaScript/TypeScript execution environment with no common enterprise application use case. Any Deno runtime execution on enterprise endpoints (deno.exe) not associated with developer tooling should generate an immediate alert, as legitimate enterprise workloads have almost no reason to use Deno outside of development environments.

Sources & Further Reading

Attribution and references used to build this profile.

• MITRE ATT&CK — MuddyWater (G0069)
• HarfangLab — MuddyWater campaign abusing Atera Agents (2025)
• Deep Instinct — DarkBeatC2: The Latest MuddyWater Attack Framework (2024)
• The Hacker News — Iran-Linked MuddyWater Deploys Atera for Surveillance in Phishing Attacks (2024)
• The Hacker News — Iranian Hackers Deploy New BugSleep Backdoor in Middle East Cyber Attacks (2024)
• The Hacker News — Iran-Linked MuddyWater Targets 100+ Organizations in Global Espionage Campaign (2025)
• Sekoia.io — MuddyWater replaces Atera by custom MuddyRot implant (2024)
• Picus Security — DEV-1084 and MERCURY: Inside Iran's DarkBit Ransomware Operations