Microsoft: Iranian hackers behind retaliatory cyberattacks on US orgs

Microsoft has discovered that an Iranian hacking group known as ‘Mint Sandstorm’ is conducting cyberattacks on US critical infrastructure in what is believed to be retaliation for recent attacks on Iran’s infrastructure. Mint Sandstorm is the new name for the Phosphorous hacking group, believed to work for the Iranian government and linked to the Islamic Revolutionary Guard Corps (IRGC). In a new report, researchers in Microsoft’s Threat Intelligence team explain that a subgroup of Mint Sandstorm switched from performing surveillance in 2022 to performing direct attacks on US critical infrastructure. The theory is that these intrusions are in retaliation for attacks on Iran’s infrastructure that the country attributed to the US and Israel. These include destructive attacks on Iran’s railway system in June 2021 and a cyberattack causing an outage at Iranian gas stations in October 2021. Microsoft believes the Iranian government is now allowing state-sponsored threat actors more freedom when conducting attacks, leading to an overall increase in cyberattacks. “This targeting also coincided with a broader increase in the pace and the scope of cyberattacks attributed to Iranian threat actors, including another Mint Sandstorm subgroup, that Microsoft observed beginning in September 2021,” Microsoft warns in today’s report on Mint Sandstorm.

https://www.bleepingcomputer.com/news/security/microsoft-iranian-hackers-behind-retaliatory-cyberattacks-on-us-orgs/