What other aliases and vendor names is Storm-1175 known by?

Storm-1175 is tracked across the cybersecurity industry by multiple aliases, including: no other verified aliases.

What are the primary motivations and sponsors of Storm-1175?

Storm-1175 operates from China with primary motivation categorized as Espionage and intelligence gathering, sponsored or affiliated with Chinese Government (State-sponsored).

What vulnerabilities and CVEs does Storm-1175 actively exploit?

Storm-1175 has been observed weaponizing vulnerabilities including CVE-2023-23397.

Storm-1175

ACTIVE CAMPAIGN TRACKED ▲ High Threat China

Primary Aliases: No secondary vendor aliases recorded.

Sponsor / State Affiliation Chinese Government (State-sponsored)

Primary Motivation Espionage and intelligence gathering

Active Timeline Unknown – Present

Confidence Rating 90% (Grounded)

CVE-2023-23397 Exploitation Campaign

⚔️ Weaponized CVE Matrix (1)

CVE-2023-23397

Outlook NTLM Relay

CVSS 9.8 KEV EPSS 92.0%

🎯 Target Sectors & Focus

Government Agencies Defense Industrial Base Telecommunications Information Technology High-value individual email accounts

🛡️ MITRE ATT&CK® Attack Lifecycle (5 TTPs)

📥 Download Navigator JSON

Initial Access 2

T1566.001 Spearphishing Attachment

↗

T1078 Valid Accounts

↗

Operational Techniques 3

T1557.001 T1557.001 (Adversary-in-the-Middle: NTLM Relay)

↗

T1555 T1555 (Credentials from Password Stores)

↗

T1000 Exploitation of CVE-2023-23397

↗

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

No recent breaking campaign alerts recorded in the FlagThis threat database.

Copied to clipboard

LINK COPIED TO CLIPBOARD

Storm-1175

⚔️ Weaponized CVE Matrix (1)

🎯 Target Sectors & Focus

🛡️ MITRE ATT&CK® Attack Lifecycle (5 TTPs)

📰 Verified Campaigns & Intelligence Archive

SHARE INTELLIGENCE WIRE