Iranian APT Groups: Names, Aliases, Targets, and Defenses

Iranian APT groups are intrusion sets and cyber operators that credible public sources associate with Iranian state interests. Priority examples include APT33, OilRig/APT34, Magic Hound/APT35, APT42, MuddyWater, APT39, Fox Kitten, UNC1860, and the OT-focused CyberAv3ngers. This is not a definitive ranking: vendors may assign different names to overlapping but not necessarily identical activity. Temporary clusters, access providers, destructive units, and public personas further complicate the picture. This guide reconciles source-owned names cautiously, distinguishes assessed relationships from confirmed cross-references, and turns the observed behavior into defensive priorities for enterprise, cloud, identity, and OT teams.

Key takeaways

• An alias is valid only within the scope defined by its source. Shared malware, sponsorship, infrastructure, or targets does not prove two labels describe the same team.
• Iranian state-linked activity spans espionage, credential collection, access brokerage, disruption, OT targeting, data theft, and cyber-enabled influence operations.
• Credential phishing, password spraying, valid-account abuse, and manipulation of MFA processes remain important defensive concerns.
• Internet-facing edge systems, remote-access services, and exposed OT devices can create disproportionately serious risk.
• APT42 should not be automatically collapsed into APT35 or Magic Hound; MITRE preserves the originating vendor’s distinction despite reported overlap.
• MuddyWater and OilRig/APT34 are maintained as separate activity sets by MITRE and Microsoft.
• Sources and changing claims in this guide were last verified on July 13, 2026. Current advisories and indicators should be rechecked when used operationally.

How to use this guide: Use the naming crosswalk to reconcile labels, the at-a-glance table to compare scope, the behavior matrix to plan detection, and the decision tree to set defensive priority. This is an evergreen decision guide, not a live IOC feed.

Methodology and relationship labels

Scope and verification methodology: This guide includes actors with credible public-source assessments connecting their activity to Iranian state interests. Inclusion reflects source quality, recency, operational relevance, and distinct defensive implications not a claim to list every Iranian actor. Names follow the organizations that originated or maintain them. “Active” is used only when dated reporting supports recent activity. Current infrastructure and indicators are time-sensitive, while an absence of recent reporting does not prove inactivity. Attribution remains an analytic assessment, not mathematical certainty.

What Are Iranian APT Groups?

In this context, an advanced persistent threat is an intrusion set that researchers track over time because its objectives, resources, access methods, or operating patterns suggest sustained, coordinated activity. “APT” describes analytical tracking and operational persistence; it is not a universal certification of sophistication.

Public sources use several attribution terms:

• State-sponsored generally means a source assesses that a government directs, funds, or materially supports the activity.
• State-linked indicates a credible connection without necessarily establishing command-and-control.
• State-aligned describes activity that advances state interests but may lack proof of government direction.
• Affiliated asserts an organizational relationship, normally with a named government unit.
• Suspected signals material uncertainty.

These terms are not interchangeable. For example, U.S. Cyber Command identifies MuddyWater as a subordinate element of Iran’s Ministry of Intelligence and Security, while MITRE describes APT33 more cautiously as a suspected Iranian group. For wider context, see DeepStrike’s guide to state-sponsored hacking and APT threats.

Not every Iranian hacktivist channel, data-leak account, cybercriminal, or geopolitical persona is an APT. A persona may front for a state unit, amplify stolen data, exaggerate responsibility, or operate independently. Attribution can also change when researchers obtain new telemetry or split a previously broad cluster into narrower groups.

Why Are Iranian Threat-Actor Names So Confusing?

Threat-intelligence vendors name what they can observe. One vendor may track an operational team; another may track shared infrastructure, a phishing program, a malware deployment cluster, or activity believed to serve the same sponsor. Their observation windows and evidence differ.

Microsoft currently assigns weather-themed names by assessed origin Sandstorm for Iran and uses Storm-#### for temporary or developing clusters. MITRE maintains group pages that list “associated groups,” but association should not automatically be interpreted as exact identity. Mandiant uses numbered APT labels for established groups and UNC labels for uncategorized clusters. The Microsoft naming taxonomy and MITRE ATT&CK group catalog therefore serve related but different purposes.

Is APT42 the same as APT35 or Charming Kitten?

Not as a universal cross-vendor identity. Mandiant tracks APT42 as an IRGC Intelligence Organization-linked espionage group and reports activity overlap with labels including Charming Kitten, Mint Sandstorm, Phosphorus, and TA453. MITRE nevertheless states that APT42 and Magic Hound have overlapping behavior and software but “appear to be distinct entities” and preserves the originating vendor’s separation. Defenders should retain both scopes unless a specific source explicitly maps a particular campaign.

Is MuddyWater the same as APT34 or OilRig?

Maintained sources track them separately. Microsoft maps MuddyWater-related activity to Mango Sandstorm, while OilRig/APT34 maps to Hazel Sandstorm. MITRE also maintains separate MuddyWater and OilRig profiles. Similar regional targeting, government affiliation, or tooling is not sufficient evidence to merge them.

Iranian threat-actor names reflect different vendor scopes; a shared line does not always mean identical groups.

Legend: Solid connectors indicate an explicit source cross-reference. Dashed connectors indicate associated or overlapping activity. “Related” does not mean identical; temporary labels remain provisional; uncertain relationships remain unconfirmed. Sources: Microsoft’s naming taxonomy, MITRE ATT&CK profiles, and Google Threat Intelligence research.

Iranian APT Groups at a Glance

Other relevant Iranian-linked clusters and personas

These examples should not be treated as equivalent categories:

• Void Manticore / Red Sandstorm: Microsoft explicitly maps Red Sandstorm to Void Manticore and related labels. MITRE associates personas including Handala and Homeland Justice with this MOIS-assessed destructive and hack-and-leak activity. A persona’s claim is not independent attribution.
• Cotton Sandstorm / Emennet Pasargad: Microsoft associates this scope with cyber-enabled influence activity and public personas. It is not simply another name for an espionage-focused intrusion group.
• CURIUM / Crimson Sandstorm / Tortoiseshell: Microsoft and MITRE cross-reference these labels in activity involving social engineering and strategic targets, including IT service providers in the Middle East.
• Moses Staff / Marigold Sandstorm: Microsoft assesses Moses Staff as operated by a different Iranian state actor than Cotton Sandstorm. Treat it primarily as a destructive or hack-and-leak persona rather than assuming it is an enduring APT organization.
• CopyKittens and Leafminer: Maintained ATT&CK entries provide historical context, but historical profiling alone does not establish current activity.

Recent context: Symantec's March 2026 overview also covers Marshtreader (Pink Sandstorm/Agrius) and DieNet. Keep these source-specific labels outside the core APT table; they are not aliases for the groups above.

Priority Actor Profiles

APT33 / Peach Sandstorm

• Label and mappings: MITRE maintains APT33 and associates Peach Sandstorm, HOLMIUM and Elfin. Microsoft currently uses Peach Sandstorm.
• Affiliation: MITRE calls it a suspected Iranian group; Microsoft assesses an IRGC connection.
• Public window: Operations are reported since at least 2013. Microsoft’s latest material example used here covers April–July 2024.
• Mission: Intelligence collection and durable access rather than one uniform destructive mission.
• Targets: Aerospace, satellite communications, energy, and federal or regional government organizations in the United States and Middle East.
• Behavior: Microsoft reported password spraying, social engineering, cloud-hosted infrastructure and custom tooling.
• Defender priority: Protect cloud and remote-access identities, detect distributed password spraying, and review exposed services. See MITRE’s APT33 profile and Microsoft’s 2024 research.

OilRig / APT34 / Hazel Sandstorm

• Label and mappings: MITRE maintains OilRig and lists APT34, Hazel Sandstorm, Crambus, Earth Simnavaz and other associated labels.
• Affiliation: Public sources describe a suspected Iranian-government nexus; open reporting does not settle every unit-level claim.
• Public window: Activity is reported since at least 2014. The latest material campaign evidence used here was published in October 2024.
• Mission: Espionage, credential collection and sustained access.
• Targets: Government, energy, financial, chemical and telecommunications organizations, particularly in the Middle East.
• Behavior: Reported activity includes exploitation of public-facing systems, credential access, email-environment targeting and use of legitimate remote-management capabilities.
• Defender priority: Prioritize perimeter patching, email and identity telemetry, service-account hygiene, and controls over remote administration. Sources: MITRE OilRig and Trend Micro’s Earth Simnavaz research.

Magic Hound / APT35 / Mint Sandstorm

• Label and mappings: MITRE maintains Magic Hound and lists APT35, Charming Kitten, Phosphorus, TA453 and Mint Sandstorm as associated groups. Microsoft describes Mint Sandstorm as a composite scope.
• Affiliation: MITRE describes Iranian-sponsored activity likely linked to the IRGC.
• Public window: Reported since at least 2014. Microsoft published a campaign update in January 2024.
• Mission: Intelligence collection through targeted social engineering and account access.
• Targets: Government and military personnel, academics, researchers, journalists, policy experts and civil-society organizations.
• Behavior: Tailored approaches, compromised accounts and credential-focused phishing are prominent in public reporting.
• Defender priority: Protect high-risk people and their personal as well as corporate accounts; strengthen email authentication and session controls. See MITRE Magic Hound and Microsoft’s Mint Sandstorm report.

APT42

• Label and mappings: APT42 is a Mandiant label. Mandiant reports overlap with Charming Kitten, Mint Sandstorm, Phosphorus, TA453 and other scopes; this does not make every label synonymous.
• Affiliation: Mandiant assesses with high confidence that APT42 operates for the IRGC Intelligence Organization.
• Public window: Activity is reported since at least 2015. Material research used here was published in May and August 2024.
• Mission: Espionage and surveillance, frequently through credential collection.
• Targets: NGOs, media, academia, legal services, activists, diplomats, officials and policy researchers.
• Behavior: Targeted social engineering, impersonation, cloud credential collection, and access to personal or enterprise email accounts.
• Defender priority: Apply phishing-resistant MFA, harden account recovery, monitor session and token risk, and provide enhanced protection to high-risk individuals. Sources: Mandiant’s APT42 analysis, Google TAG, and MITRE APT42.

MuddyWater / Mango Sandstorm

• Label and mappings: MITRE associates MuddyWater with Mango Sandstorm, Mercury, Seedworm, Static Kitten, TEMP.Zagros and TA450.
• Affiliation: U.S. Cyber Command publicly identifies MuddyWater as a subordinate element of MOIS.
• Public window: Reported since at least 2017. Symantec and Unit 42 published new activity observations in March 2026.
• Mission: Espionage, persistent access and intelligence collection.
• Targets: Government, telecommunications, finance, defense, energy, maritime, diplomatic and technology organizations across multiple regions.
• Behavior: Public reporting emphasizes social engineering, valid access, scripts, legitimate administration or remote-management tools, collection and attempted exfiltration.
• Recent limits: Symantec’s 2026 findings describe a defined sample of U.S. and Canadian organizations; they do not establish every victim or outcome.
• Defender priority: Monitor legitimate remote tools, script execution, unusual account use and outbound transfer patterns. Sources: U.S. Cyber Command, MITRE MuddyWater, Symantec, and Unit 42.

APT39 / Chafer / Rana-linked activity

• Label and mappings: MITRE maintains APT39 and lists Chafer, Remix Kitten and ITG07 as associated. Rana Intelligence Computing is a government-identified front, not merely another group alias.
• Affiliation: The U.S. Department of Justice and Treasury linked Rana-supported APT39 activity to MOIS.
• Public window: Operations are reported since at least 2014. The selected recent source is a maintained profile, not evidence of a new 2026 campaign.
• Mission: Intelligence collection and the tracking of people and organizations.
• Targets: Telecommunications, travel, hospitality, government and academia across the Middle East and other regions.
• Behavior: Credential collection, network access, surveillance-oriented collection and broad targeting of organizations holding travel or communications data.
• Defender priority: Protect identity stores, customer and travel data, telecom access, and privileged investigative systems. Sources: MITRE APT39 and the DOJ’s coordinated action concerning Rana.

Fox Kitten / Pioneer Kitten / Lemon Sandstorm

• Label and mappings: MITRE and AA24-241A cross-reference Fox Kitten, Pioneer Kitten, Lemon Sandstorm, Parisite, RUBIDIUM and UNC757.
• Affiliation: U.S. agencies describe an Iran-based group supporting state objectives, but public unit-level attribution remains less specific than for MuddyWater or APT42.
• Public window: Reported since at least 2017; the joint ransomware-enablement advisory was published Aug. 28, 2024.
• Mission: Developing initial access for intelligence objectives and, in documented cases, enabling ransomware affiliates.
• Targets: Education, municipal government, finance, healthcare, defense, technology and other organizations with vulnerable internet-facing systems.
• Behavior: Exploitation of known vulnerabilities, persistence, credential access and handoff or sale of access.
• Defender priority: Patch exposed products, isolate administrative interfaces, rotate credentials after edge compromise, and look beyond the initial appliance. See CISA AA24-241A and MITRE Fox Kitten.

UNC1860

• Label and mappings: UNC1860 is Mandiant’s provisional cluster. Reported parallels with Shrouded Snooper, Scarred Manticore and Storm-0861 are overlaps, not established aliases.
• Affiliation: Mandiant assesses the cluster as a likely MOIS actor.
• Public window: Mandiant published the profile on Sept. 19, 2024, drawing on earlier engagements.
• Mission: Probable initial access and persistent footholds that could support other Iranian operations.
• Targets: Government and telecommunications networks in the Middle East.
• Behavior: Opportunistic exploitation of internet-facing servers and stealthy mechanisms designed to preserve access.
• Evidence limit: Mandiant noted operational parallels but could not corroborate every proposed handoff to previously reported destructive activity.
• Defender priority: Monitor edge systems, rebuild compromised servers when integrity is uncertain, and search for persistence beyond the initially exploited service. Source: Mandiant’s UNC1860 analysis.

CyberAv3ngers / Shahid Kaveh Group

• Label and mappings: CISA associates CyberAv3ngers with the Shahid Kaveh Group for prior PLC activity. MITRE lists Soldiers of Solomon as related rather than necessarily identical.
• Affiliation: U.S. agencies associate the prior activity with the IRGC Cyber-Electronic Command.
• Public window: MITRE reports activity since at least 2020. The best-documented PLC campaign occurred in 2023.
• Mission: OT disruption, public claims and psychological effect.
• Targets: Water, energy and other organizations operating reachable industrial control equipment.
• Behavior: Access to internet-facing PLCs, configuration or display changes, and public claims. Some claimed operations have been disputed.
• Recent limit: AA26-097A reports new Iranian-affiliated PLC exploitation beginning in March 2026 but does not attribute that new activity to CyberAv3ngers by name.
• Defender priority: Remove direct PLC exposure, secure remote engineering paths, replace default credentials, retain known-good configurations and monitor changes. Sources: CISA AA26-097A, its FBI/IC3 PDF, and MITRE CyberAv3ngers.

What Recent Advisories Show: 2024–2026

Each row describes a different source scope. The table must not be read as a single continuous campaign or a universal Iranian operating model.

Commonly Observed Behaviors and ATT&CK Patterns

Iranian-linked activity is better understood as a collection of source-specific behaviors than as one merged ATT&CK profile. The following matrix maps documented examples to defensible telemetry and control goals.

Related: DeepStrike’s phishing statistics and trends and compromised credential trends.

Sources: CISA AA24-290A, CISA AA26-097A, MITRE ATT&CK, and the named primary research above. The model does not claim that every actor uses every behavior.

Which Organizations Should Prioritize This Threat?

Priority should reflect mission, exposure and consequences—not nationality or ethnicity.

Sources: current CISA, FBI and NSA guidance. The outcome establishes a defensive review priority; it does not predict that a particular organization will be attacked.

A Defender-First Priority Framework

The first objective is not to guess the perfect actor label. It is to reduce reachable attack paths, make account misuse visible, constrain privilege and preserve recovery options.

How Authorized Security Testing Helps

Authorized, scoped testing can validate whether an organization’s actual controls match its threat model. Depending on scope and safety requirements, it may:

• Validate exposed paths through public applications, identity systems and remote access.
• Assess privilege boundaries, account recovery and session controls.
• Test IT/OT segmentation without interfering with operational safety.
• Confirm that email, identity, cloud, endpoint, network and OT telemetry supports investigation.
• Exercise escalation, containment, restoration and communications workflows.
• Verify remediation through controlled retesting.

Testing must operate under written authorization, an approved scope, rules of engagement, safety controls and asset-owner permission. OT exercises require particular coordination with engineering and operations personnel.

A penetration test or red-team exercise does not prove attribution, recreate every capability of a named state actor, guarantee breach prevention, or replace threat intelligence, monitoring, incident response, governance and OT engineering. Organizations should also distinguish red team and blue team roles and understand vulnerability assessment versus penetration testing before choosing an engagement.

For organizations that need a controlled assessment of exposed paths, identity boundaries and detection workflows, DeepStrike’s red teaming services can support authorized validation and remediation planning within an agreed scope.

Common Mistakes

• Treating every associated name as an exact synonym.
• Collapsing APT42 into APT35 or Magic Hound without retaining Mandiant’s distinct scope.
• Combining MuddyWater with OilRig/APT34 because both are linked to Iranian government interests.
• Calling every Iranian-linked persona, leak account or hacktivist channel an APT.
• Treating shared sponsorship as proof that several intrusion sets are one team.
• Calling a group active solely because a historical profile still exists.
• Relying on malware hashes or static indicators after infrastructure has changed.
• Focusing on endpoints while overlooking identity, SaaS, personal accounts, edge systems and OT.
• Repeating geopolitical speculation or public claims as attribution evidence.
• Assuming one red-team exercise proves continuing readiness.

Defensive Checklist

For CISOs and security leaders

• ☐ Assign accountable owners for internet-facing IT and OT assets, including third-party remote access. (AA26-097A)
• ☐ Identify strategically relevant operations, datasets and high-risk roles without using ethnicity or nationality as a risk signal. (Google TAG APT42)
• ☐ Rehearse identity compromise, destructive attack, data-disclosure and OT-disruption decisions. (AA26-097A)

For SOC and incident-response teams

• ☐ Detect distributed password spraying, successful access after failures, MFA prompt bursts and registration changes. (AA24-290A)
• ☐ Baseline approved remote-management and administrative tools, then investigate unusual operators or destinations. (MuddyWater 2026 research)
• ☐ Treat current IOCs as investigative leads with dates and provenance, not permanent attribution rules. (AA24-290A)
• ☐ Preserve identity, cloud, endpoint, network and OT evidence before disruptive remediation where safety permits. (AA26-097A)

For identity and cloud teams

• ☐ Deploy phishing-resistant MFA for privileged and high-risk accounts; reduce reliance on approval-only push prompts. (AA24-290A)
• ☐ Review legacy authentication, service accounts, OAuth consent, token use, session risk and account-recovery changes. (APT42 research)
• ☐ Offer enhanced protection for executives, researchers, journalists and policy personnel whose personal accounts intersect with sensitive work. (Google TAG)

For OT owners and engineering teams

• ☐ Remove PLCs from direct internet exposure and mediate remote access through controlled gateways. (AA26-097A)
• ☐ Replace default credentials and require MFA where the architecture supports it. (AA26-097A)
• ☐ Maintain protected, offline known-good configurations and test restoration with asset-owner approval. (AA26-097A PDF)
• ☐ Monitor changes to PLC logic, HMI/SCADA data, remote tools and expected industrial protocols. (AA26-097A)

Frequently Asked Questions

What are the main Iranian APT groups?

Publicly prioritized examples include APT33, OilRig/APT34, Magic Hound/APT35, APT42, MuddyWater, APT39, Fox Kitten, UNC1860 and CyberAv3ngers. That is a defensively useful selection, not a ranking or exhaustive list. Some are established intrusion sets; others are provisional clusters, access specialists or OT-focused actors.

Why do Iranian APT groups have so many aliases?

Each intelligence provider observes and scopes activity differently. A label may describe a team, infrastructure cluster, campaign, malware ecosystem or sponsor-aligned program. Use the originating source’s mapping and distinguish explicit cross-references from overlap.

Are APT35 and APT42 the same group?

Not universally. Mandiant reports overlap between APT42 and several APT35/Charming Kitten-related scopes, but MITRE tracks APT42 and Magic Hound separately to preserve the originating vendor’s distinction. Defenders should not merge them without campaign-specific evidence.

Are MuddyWater and APT34 the same group?

Maintained sources say no. Microsoft maps MuddyWater to Mango Sandstorm and OilRig/APT34 to Hazel Sandstorm, while MITRE keeps separate group profiles. Similar sponsorship or tactics does not establish identity.

Which Iranian-linked actor is associated with PLC and OT targeting?

CyberAv3ngers, also associated by CISA with the Shahid Kaveh Group for prior activity, is the best-known public example. However, AA26-097A does not name CyberAv3ngers as the operator behind the new March 2026 PLC activity; it calls the actors Iranian-affiliated.

Which sectors are commonly targeted?

Public reporting repeatedly covers government, defense, energy, water, telecommunications, technology, finance, travel, logistics, research, academia, media, NGOs and civil society. Relevance depends on mission, relationships, exposed systems, sensitive data and high-risk personnel—not sector alone.

How can organizations detect Iranian APT activity?

Start with behavior: password spraying, unusual MFA prompts, valid-account misuse, suspicious account-recovery changes, exploitation of exposed systems, anomalous remote tools, unusual cloud or mailbox access, data staging and unauthorized OT changes. Correlate identity, cloud, endpoint, email, network and OT evidence before drawing attribution conclusions.

Can penetration testing or red teaming protect against an APT?

It can validate attack paths, control boundaries, telemetry and response under controlled conditions. It cannot prove attribution, reproduce every nation-state capability or guarantee prevention. Its value depends on written authorization, representative scope, safe execution, remediation and retesting.

Conclusion

Iranian threat-actor labels will continue to change as vendors divide, merge and reinterpret the activity they observe. The durable defensive priorities are clearer: reduce internet exposure, strengthen identity, monitor behavior across enterprise and OT environments, constrain legitimate administrative tools, and preserve tested recovery options.

Use the latest official advisories for time-sensitive indicators and mitigations. Validate controls through authorized testing, but keep attribution conclusions tied to evidence and the source that made the assessment.

About the Author

Mohammed Khalil is a Cybersecurity Architect and SEO Specialist at DeepStrike. He holds CISSP, OSCP, and OSWE certifications and writes about penetration testing, threat intelligence, and translating technical risk into practical defensive priorities.