Storm-1567

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat unknown

Primary Aliases: PUNK SPIDER Akira Darter G1024

Sponsor / State Affiliation Criminal organization

Primary Motivation Financial gain via ransomware payments and data theft/extortion

Active Timeline Unknown – Present

Confidence Rating 90% (Grounded)

Cisco VPN Exploitation Campaign, Global Double Extortion Wave

⚔️ Weaponized CVE Matrix (1)

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Healthcare Education Financial Services Government Manufacturing Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (7 TTPs)

📥 Download Navigator JSON

Initial Access 2

T1566 Exploitation of Cisco ASA/FTD VPN vulnerabilities (missing MFA)

T1566 Use of compromised credentials for initial access

Lateral Movement & Collection 1

T1021 Lateral movement via PsExec and AnyDesk

Command & Control 2

T1071 Utilization of Rclone for data exfiltration

T1071 Deployment of Cobalt Strike for Command and Control (C2)

Exfiltration & Impact 1

T1485 Double extortion leveraging a dedicated leak site

Operational Techniques 1

T1000 Disabling of security software and backup agents

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Akira Ransomware: Neutralizing Microsoft Defender and Huntress via BCDEDIT and Safe Mode

Attacks and Vulnerabilities 2026-08-17

[DEEP DIVE] The Rust Paradox: Memory-Safe Defense vs. Evasive Offensive Weaponization

Attacks and Vulnerabilities 2026-08-22

[DEEP DIVE] Microsoft Defender: RoguePlanet Zero-Day CVE-2026-50656 and Woodgnat Exploitation

Attacks and Vulnerabilities 2026-07-01

[DEEP DIVE] Akira Ransomware Breach: Sunrise Company and Associated Luxury Entities

Attacks and Vulnerabilities 2026-05-29

Copied to clipboard

LINK COPIED TO CLIPBOARD