Cotton Sandstorm is an Iranian threat actor involved in hack-and-leak operations. They have targeted various organizations, including the French satir...

Threat Actor Profile

Cotton Sandstorm

State-sponsored threat group originating from IR. Suspected sponsor: Iran (Islamic Republic of). Known to target Government, Finance, High-Tech and 5 other sectors.

8 Industries Tracked Real-Time Alerts

Actor Overview

Origin Country
IR
Suspected Sponsor
Iran (Islamic Republic of)
Incident Types
Information Operations

Target Industries

GovernmentFinanceHigh-TechTelecomsNGOsCivil SocietyRailEnergy

Suspected Victims

United StatesIsraelMiddle EastEurope

Related Threat Reports

Premium
APT Campaign Analysis - Q4 2025Dec 2025
New Tactics Observed in WildDec 2025
Infrastructure Mapping ReportDec 2025
Stay Updated

Get alerts when new intel on Cotton Sandstorm is published.

Actor Details

Primary Name
Cotton Sandstorm
Known Aliases
Emennet Pasargad, Holy Souls, MARNANBRIDGE, NEPTUNIUM
Data Source
Precursor Intelligence
Need API Access?

Integrate threat actor data into your SIEM or SOAR.

View Plans →