Mango Sandstorm
Attribution profile
- Type
- Nation State
- Location
- Iran
- Known incidents
- 18 incidents
- Sources
- 10 sources
- First seen
- 2016-12-01
- Last seen
- 2023-12-01
- Updated
- 2026-10-11 02:48
- Aliases
- 6 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Mango Sandstorm is an Iranian state‑sponsored threat actor also known by that alias. The group is linked to Iranian intelligence and military entities and has been observed exploiting the pre‑authentication remote code execution vulnerability CVE‑2023‑27350 in unpatched print management servers to gain initial network access. This activity, first noted in March 2023, targeted organizations worldwide across sectors such as large enterprises, government agencies and educational institutions, and the access obtained enabled follow‑on ransomware deployment by other threat actors including Lace Tempest and LockBit. Mango Sandstorm’s tactics involve evolving exploitation techniques that bypass existing detections, allowing continued use of the vulnerability after public disclosure and proof‑of‑code release.
Incidents
Attributed incidents are available to members.
18 incidentsSources
Sources available to members: 10 sources.