UnclassifiedIdeologyAdvanced sophistication
Gray Sandstorm
Gray Sandstorm is a threat actor group with an ideological motive, tracked by Brandefense. It uses 5 MITRE ATT&CK techniques.
Also known as
- DEV-0343
- Techniques
- 5
- Exploited CVEs
- No CVE data
- Record updated
About Gray Sandstorm.
Gray Sandstorm is an Iran-linked threat actor that has been active since at least 2012. They have targeted defense technology companies, maritime transportation companies, and Persian Gulf ports of entry. Their primary method of attack is password spraying, and they have been observed using tools like o365spray. They have a specific focus on US and Israeli targets and are likely operating in support of Iranian interests.
Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.