Who is Subgroup: TA455, Smoke Sandstorm?

Subgroup: TA455, Smoke Sandstorm is a threat actor attributed to IR, also known as TA455, Smoke Sandstorm, Bohrium. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Subgroup: TA455, Smoke Sandstorm exploit?

Specific CVE exploitation data for Subgroup: TA455, Smoke Sandstorm is being tracked. Check the Strobes VI threat actor profile for updates.

Agentic AI · Pentesting

Ready for Agentic Automated Testing?

Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.

Zero false positives

PoC for every finding

30+ tools orchestrated

Book a Demo Learn More

Setup in 5 minutesSOC 2 & ISO 27001

Subgroup: TA455, Smoke Sandstorm

Also known as: TA455, Smoke Sandstorm, Bohrium, DEV-0056, Yellow Dev 13, UNC1549, BOHRIUM, IMPERIAL KITTEN, Nimbus Manticore

IRInformation theft and espionage

Exploited CVEs

Overview

A subgroup of Magic Hound, APT 35, Cobalt Illusion, Charming Kitten . ( Microsoft ) Smoke Sandstorm (formerly BOHRIUM/DEV-0056) compromised email accounts at a Bahrain-based IT integration company in September 2021. This company works on IT integration with Bahrain Government clients, who were likely Smoke Sandstorm’s ultimate target. Smoke Sandstorm also compromised various accounts at a partially government-owned organization in the Middle East that provides information and communications technology to the defense and transportation sectors, which are targets of interest to the Iranian regime. In May of 2022, Microsoft took legal action to disrupt spear phishing operations linked to Smoke Sandstorm. There seems to be overlap with Tortoiseshell, Imperial Kitten .

Exploited Vulnerabilities

No exploited CVEs have been attributed to this threat actor yet.

Browse CVE Database