Subgroup: TA455, Smoke Sandstorm - Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 20:23:11 UTC Home > List all groups > Subgroup: TA455, Smoke Sandstorm APT group: Subgroup: TA455, Smoke Sandstorm Names TA455 (ClearSky) Smoke Sandstorm (Microsoft) Bohrium (Microsoft) DEV-0056 (Microsoft) Yellow Dev 13 (PWC) UNC1549 (Mandiant) Country Iran Motivation Information theft and espionage First seen 2021 Description A subgroup of Magic Hound, APT 35, Cobalt Illusion, Charming Kitten. (Microsoft) Smoke Sandstorm (formerly BOHRIUM/DEV-0056) compromised email accounts at a Bahrain-based IT integration company in September 2021. This company works on IT integration with Bahrain Government clients, who were likely Smoke Sandstorm’s ultimate target. Smoke Sandstorm also compromised various accounts at a partially government-owned organization in the Middle East that provides information and communications technology to the defense and transportation sectors, which are targets of interest to the Iranian regime. In May of 2022, Microsoft took legal action to disrupt spear phishing operations linked to Smoke Sandstorm. There seems to be overlap with Tortoiseshell, Imperial Kitten. Observed Sectors: Aerospace, Aviation, Defense. Countries: Albania, India, Israel, Turkey, UAE and Middle East. Tools used LIGHTRAIL, MINIBIKE, MINIBUS, SlugResin, SnailResin. Operations performed Jun 2022 When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1f9277fa-f9e5-4a0b-a2a0-2179ddc62c86 Page 1 of 2 Sep 2023 Operation “Iranian Dream Job” Iranian “Dream Job” Campaign 11.24 Information Last change to this card: 29 December 2024 Download this actor card in PDF or JSON format Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1f9277fa-f9e5-4a0b-a2a0-2179ddc62c86 https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1f9277fa-f9e5-4a0b-a2a0-2179ddc62c86 Page 2 of 2