{"actor":{"id":"cotton-sandstorm","name":"Cotton Sandstorm","aliases":["NEPTUNIUM","Emennet Pasargad","MARNANBRIDGE","DEV-0166","Yellow Candor"],"vendor_names":{"microsoft":"Cotton Sandstorm","crowdstrike":"HAYWIRE KITTEN","mitre":"G1009"},"mitre_gid":"G1009","type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"IR","origins":["IR"],"targets":["AE","BH","FR","IL","IQ","IR","LB","PS","US","YE"],"target_regions":[],"sectors":["edu","hospitality","mar","tel","logistics","transportation","ngo","gov","fin","manufacturing-man","med","tec","energy-utilities"],"threat_types":["dis"],"mitre_techniques":[],"gir_codes":[],"active_since":2017,"brief":null,"attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:19.493817+00:00","updated_at":"2026-07-29T07:05:52.263+00:00","url":"https://aptatlas.net/actors/cotton-sandstorm"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/cotton-sandstorm/stix","navigator":"https://aptatlas.net/api/v1/actors/cotton-sandstorm/navigator"}}