{"actor":{"id":"cotton-sandstorm","name":"Cotton Sandstorm","aliases":["NEPTUNIUM","Emennet Pasargad","MARNANBRIDGE","DEV-0166","Yellow Candor","Emennet Pasargad Ltd","Aria Sepehr Ayandehsazan","Cyber Flood","Homeland Justice"],"vendor_names":{"microsoft":"Cotton Sandstorm","crowdstrike":"HAYWIRE KITTEN","mitre":"G1009"},"mitre_gid":"G1009","type":"nation-state","type_verbatim":"nation-state APT","secondary_types":[],"origin":"IR","origins":["IR"],"targets":["AE","BH","FR","IL","IQ","IR","LB","PS","US","YE"],"target_regions":[],"sectors":["edu","energy-utilities","fin","gov","hospitality","logistics","manufacturing-man","mar","med","ngo","tec","tel","transportation"],"threat_types":["dis"],"mitre_techniques":[],"gir_codes":[],"active_since":2017,"brief":null,"attribution_sponsor":null,"attribution_confidence":null,"merged_into":null,"split_from":[],"created_at":"2026-05-20T09:52:19.493817+00:00","updated_at":"2026-08-03T17:53:56.387+00:00","url":"https://aptatlas.net/actors/cotton-sandstorm"},"exports":{"stix":"https://aptatlas.net/api/v1/actors/cotton-sandstorm/stix","navigator":"https://aptatlas.net/api/v1/actors/cotton-sandstorm/navigator"}}