First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, pending additional conclusive information. A notable characteristic is its use of the LuaDream backdoor. LuaDream is based on the Lua platform, a relatively rare occurrence in the cyberespionage domain, historically associated with APTs considered Western or Western-aligned.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| Various | Sandman APT |
Sectors: Government, Telecommunications
Victim countries: Middle East, Southeast Asian, France, Egypt, Sudan, South Sudan, Libya, Turkey, Saudi Arabia, Oman, Yemen, Sri Lanka, India, Pakistan, Iran, Afghanistan, Kuwait, Iraq, United Arab Emirates
No techniques mapped yet.
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Sandman APT, newest first. Open any report to see the full analysis with provenance.
No reports in the Lore library name this actor yet.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Sandman APT. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.