Altoufan Team

Executive Summary

Altoufan Team, often operating under the moniker Cotton Sandstorm, is an Iran‑linked threat actor engaged in politically driven campaigns that blend credential theft, ransomware, and information‑leak tactics. Their operations target a wide array of high‑value sectors—government, defense, critical infrastructure, finance and energy—and employ sophisticated social engineering to obtain access before launching destructive or leak‑based actions.

Goals & Targeting

This group pursues multi‑layered objectives that range from influencing public perception through hack‑and‑leak campaigns to collecting actionable intelligence for future operations. By targeting sectors directly tied to security, energy, finance and government, Altoufan Team seeks both reputational damage and strategic advantage for its aligned political entities. The use of high‑trust impersonation and fake‑ransomware tactics underscores a dual intent: immediate disruptive impact while preserving long‑term influence through data leaks.

Key Capabilities

• High‑trust impersonation via social engineering
• Targeted spearphishing campaigns (urgent software update themes)
• Credential theft using RedLine Stealer, WezRat
• Lateral movement through compromised accounts and internal phishing
• Deployment of WhiteLock ransomware and fake‑ransomware tactics
• Remote monitoring and management tool delivery via legitimate file sharing
• ASPX webshell deployment for persistence and C2
• Exploitation of misconfigured or weak internet‑exposed assets (IP cameras, external apps)
• Supply‑chain footholds through IT/service providers
• DDoS attacks to overwhelm targets
• Website defacement to convey political messaging
• VPN usage for traffic obfuscation and tunneling
• Hack‑and‑leak amplification with fake personas

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Altoufan Team’s activity is tightly linked to regional conflicts and political events, with notable operations in Bahrain and Israel where they have used credential theft and ransomware to disrupt. The actor demonstrates a consistent pattern of executing supply‑chain footholds and leveraging social engineering, enabling rapid compromise of high‑trust accounts. Their use of commercial VPN services and Starlink IP ranges points to deliberate obfuscation efforts. While the group’s first or most recent sightings remain unclear due to limited public data, their campaigns often involve large scale leak‑outs followed by targeted phishing or ransomware attempts aimed at creating sustained pressure on victims.

IOC Patterns

• Malicious email attachment mimicking urgent software update
• Phishing URL masquerading as WhatsApp, Microsoft Teams, or Google Meet
• Credential harvesting via fake messaging service phishing kit
• WezRat infostealer delivery
• WhiteLock ransomware activity
• Legitimate file sharing services used to transfer malicious RMM tools
• Starlink IP range affiliation
• Misconfigured or weak credentials on internet‑facing applications
• ASPX webshell deployment
• Living‑off‑the‑land binaries usage
• Vulnerable IP cameras with default credentials and older CVEs

Recommended Actions

• Block or quarantine email attachments purporting to be urgent software updates.
• Implement MFA—preferably phishing‑resistant—for privileged and high‑trust accounts.
• Detect and block phishing URLs mimicking messaging apps (WhatsApp, Microsoft Teams, Google Meet).
• Deploy endpoint detection for WezRat, RedLine Stealer, and other infostealers.
• Monitor network for WhiteLock ransomware indicators and apply ransomware defenses.
• Vet or restrict external RMM tool usage; enforce strict acquisition policies.
• Detect and mitigate DDoS activity originating from compromised hosts.
• Monitor traffic to commercial VPN exit nodes (Mullvad, NordVPN, PIA, ProtonVPN).
• Audit internet‑exposed assets—especially IP cameras—for default credentials and known CVEs.
• Apply MFA on cloud services such as Google Workspace and Microsoft 365.

Suggested Tags