IranAttributedEmennet Pasargad / ASAMixedActive 2020 – 2024Cotton Sandstorm
Also known asHaywire Kitten · Neptunium · Emennet Pasargad · Holy Souls · Eeleyanet Gostar · Hackers of Savior · Deus · MARNANBRIDGE · Aria Sepehr Ayandehsazan · ASA · COBALT OBELISK · Vice Leaker
Summary
Iranian cyber group Emennet Pasargad (formerly Eeleyanet Gostar), which FBI says has used the company name Aria Sepehr Ayandehsazan (ASA) as cover since at least mid-2024; Microsoft tracks it as Cotton Sandstorm. It pairs intrusions with information operations run through false-flag personas: the 2020 US election intimidation campaign, the 'Hackers of Savior' and 'Deus' hack-and-leaks against Israel, the 'Holy Souls' Charlie Hebdo leak, and — after 7 Oct 2023 — SMS messages to Israeli hostages' families, a hijacked US IPTV stream with an AI-generated news anchor, and the July 2024 compromise of a French dynamic-display provider during the Olympics. The FBI/Treasury/INCD advisory (Oct 2024) reports that it set up its own hosting resellers (Server-Speed, then VPS-Agent) to provision servers, harvested content from Israeli IP cameras, used Masscan, Acunetix, Burp Suite and SQLMap for access, weaponised the WinRAR flaw CVE-2023-38831 and deployed a trojanised Chrome installer carrying the 'bd' RAT. FBI judges its campaigns mix real intrusions with exaggerated or fictitious claims of access.
Attribution
IRGC link is press-reported, not in the advisory
Named by a government: indictment, sanctions designation, joint advisory or official statement.
- FBI, US Treasury and INCD (Government, 2024-10-30)
Iranian company Emennet Pasargad, operating as Aria Sepehr Ayandehsazan (ASA) - The Hacker News (Press, 2024-11)
Describes it as part of the IRGC
Campaigns 8
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Altoufan Team persona revival — Bahrain claimsCLAIMED | 2026-03 | Bahrain | Check Point Research (2026-03-01), persona claims | |
| 'Cyber Court' persona promoting ASA-run cover hacktivist groups (Makhlab al-Nasr, NET Hunter, Emirate Students Movement, Zeus is Talking)ASSESSED | 2024-04 – 2024-09 | Global | FBI/Treasury/INCD joint CSA (2024-10-30) — assessed | |
| 'Contact-HSTG' and 'Cyber Flood' personas — messages to Israeli hostages' families after 7 October | 2023-10 | Israel | Individuals | FBI/Treasury/INCD joint CSA (2024-10-30) |
| ASA influence ops: IP-camera harvesting, IPTV hijack and 2024 Olympics display compromise | 2023-10 – 2024-07 | Israel, USA, France, Sweden | Media, Sports, Surveillance/IP cameras, Hosting | FBI/Treasury/INCD joint CSA (2024-10-30) |
| 'Holy Souls' — Charlie Hebdo subscriber data leak and influence operation | 2023-01 | France | Media | Microsoft DTAC (2023-02-03) |
| 'Deus' persona — lock-and-leak of an Israeli call-service centre | 2021 | Israel | Business Services | FBI PIN (2022-10-20) |
| 'Hackers of Savior' persona — hack-and-leak and defacement campaigns | 2020-05 – 2022-04 | Israel | Multiple | FBI PIN (2022-10-20) |
| 2020 US presidential election influence campaign | 2020 | USA | Government, Elections | FBI/Treasury/INCD joint CSA (2024-10-30), citing DOJ indictment (2021-11) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 10
| Reconnaissance2 | T1595.001Scanning IP BlocksT1595.002Vulnerability Scanning |
|---|---|
| Resource Development3 | T1585.001Social Media AccountsT1650Acquire AccessT1588.007Artificial Intelligence |
| Initial Access1 | T1190Exploit Public-Facing Application |
| Credential Access1 | T1110.001Password Guessing |
| Command and Control1 | T1071.001Web Protocols |
| Impact2 | T1491.002External DefacementT1498Network Denial of Service |
Malware and tools 1
| Name | Description | Platform |
|---|---|---|
| bd | RAT (obfuscated; dropped by a trojanised "Google Chrome Installer.msi") | Windows |
Exploited vulnerabilities 1
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2023-38831 | 7.8 | WinRAR — code execution via crafted archive (KEV 2023-08-24) |
Highest CVSS first.
Infrastructure patterns
- Telegram channels of its own cover personas, e.g. "Cyber Court" (FBI, 2024)
- Own cover hosting resellers Server-Speed and VPS-Agent, buying from BAcloud and Stark Industries (FBI, 2024)
- Commercial VPNs — Private Internet Access, Windscribe, ExpressVPN, NordVPN and others (FBI, 2022; FBI, 2024)
Reporting and advisories 4
- FBI/Treasury/INCD joint CSA
2020 US presidential election influence campaign - Check Point Research
Altoufan Team persona revival — Bahrain claims - FBI PIN
'Hackers of Savior' persona — hack-and-leak and defacement campaigns - Microsoft
Iran responsible for Charlie Hebdo attacks (DTAC, 3 Feb 2023)