Gray Sandstorm

Summary

Iran-origin cluster Microsoft tracks as Gray Sandstorm (formerly DEV-0343). From late July 2021 it ran extensive Office 365 password sprays from Tor — emulating Firefox or Chrome and validating accounts through Exchange Autodiscover and ActiveSync — against more than 250 tenants: US and Israeli defence-technology firms, Persian Gulf ports of entry, and maritime and GIS companies with Middle East business; fewer than 20 were compromised. Microsoft assessed the targeting supports Iranian tracking of adversary security services and shipping. In March 2026, three waves of M365 password spraying hit more than 300 Israeli and over 25 UAE organisations — mainly municipalities that handle missile-strike response, plus energy, aviation, satellite and maritime firms — from rotating Tor exit nodes with an IE10 user agent, followed by logins from VPNs geolocated in Israel. Check Point attributes it to Iran at moderate confidence and notes similarities to Gray Sandstorm, so it is recorded as assessed.

Attribution

No service named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Microsoft Threat Intelligence Center (Research, 2021-10-11)
  Likely supports the national interests of Iran
• Check Point Research (Research, 2026-03-31)
  Moderate confidence: originates from Iran

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Infrastructure patterns

• Password sprays from 150–1,000+ rotating Tor exit IPs per target organisation (Microsoft, 2021)
• Activity peaks Sunday–Thursday 04:00–17:00 UTC, Iran working hours (Microsoft, 2021)

Reporting and advisories 2

• Microsoft MSTIC
  Tor-routed Office 365 password spraying — defence-technology, GIS, maritime and Persian Gulf ports of entry (250+ tenants)
• Check Point Research
  M365 password-spray waves against Israeli and UAE municipalities, energy and aviation (3, 13 and 23 March)