Sandman APT
No sourced public emblem in this profile.
reference profile · reported nexus: CN (not nationality)
First disclosed in 2023, the Sandman APT is likely associated with suspected China-based threat clusters known for using the KEYPLUG backdoor, specifically STORM-0866/Red Dev 40. Sandman is tracked as a distinct cluster, pending additional conclusive information. A notable characteristic is its use of the LuaDream backdoor. LuaDream is based on the Lua platform, a relatively rare occurrence in the cyberespionage domain, historically associated with APTs considered Western or Western-aligned.
Source-reported aliases: . Associations do not prove equivalence.
Target geography
Catalog-listed countries (associations, not attack counts): 
France · 
Egypt · 
Sudan · 
South Sudan · 
Libya · 
Türkiye · 
Saudi Arabia · 
Oman · 
Yemen · 
Sri Lanka · 
India · 
Pakistan · 
Iran · 
Afghanistan · 
Kuwait · 
Iraq · 
United Arab Emirates
No bound claim-post feed for this label.
Historical casebook
No dated record curated yet; absence does not establish inactivity.
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
No assigned review window.