APT ATLAS

Atlas Actors147 Names471 Sectors40 Requirements480

⌘K

Atlas Actors147 Names471 Sectors40 Requirements480

Imperial Kitten (aka Tortoiseshell, Smoke Sandstorm) · APT Atlas

Actors/Nation-state / APT/Asia

Imperial Kitten

G1023APTIR · Iran

AKA Tortoiseshell · Smoke Sandstorm · Yellow Liderc · Crimson Sandstorm

Microsoft: Marigold SandstormMandiant: UNC1549MITRE: G1023Proofpoint: TA456

Targets8

Sectors15

Threat types1

GIRs covered0/480

Active since2017

QUICK FACTS

TypeNation-state / APT

OriginIran

First seen2017

Type (verbatim)nation-state APT

GIR coverage0/480

TTPs0

Targets8

Sectors15

Last reviewed2026-07-29

Also tracked as

5 vendor names · 4 other aliases

Open Rosetta Stone

CrowdStrike

Imperial Kitten

Mandiant

UNC1549

Microsoft

Marigold Sandstorm

MITRE

G1023

Proofpoint

TA456

UNATTRIBUTED ALIASESTortoiseshellSmoke SandstormYellow LidercCrimson Sandstorm

Victimology

Geographic footprint · 8 countries

origin · Irantargeted countries · 8

ASIA · 4

United Arab Emirates · Israel · Qatar · Saudi Arabia

EUROPE · 2

Germany · Spain

AMERICAS · 2

United States · Uruguay

Sectors targeted

15 of 40

Government100 actors Defense72 actors Aviation22 actors Financial Services74 actors Technology60 actors Energy / Utilities59 actors Education & Research62 actors Manufacturing (man)50 actors Media & Journalism49 actors Transportation31 actors Real Estate10 actors Hospitality33 actors Consulting / Professional Services35 actors Industrials / Engineering29 actors Agriculture & Food18 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

ESP · Espionage

MITRE ATT&CK · 0 techniques

No TTPs mapped yet.

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer0 techniques · layer format 4.5

Related actors

By origin and actor type

APT31nation-state

China · 6 targets · since 2013

APT8nation-state

China · 5 targets · since —

APT24nation-state

China · 3 targets · since 2008

APT27nation-state

China · 23 targets · since 2010

APT44nation-state

Russia · 25 targets · since 2009

APT21nation-state

China · 5 targets · since 2010