FlagThis

← All Threat Actors
Threat Actor Profile

Storm-2561

No known aliases in database
▲ High Threat
Fake VPN Client Distribution Campaign
Origin —
Sponsor criminal organization
Motivation financial gain via credential theft and information stealing

Target Sectors

Enterprise organizations Remote workers utilizing VPN solutions Users of Ivanti (Pulse Secure) VPN Users of Cisco VPN Users of Fortinet VPN Users of SonicWall

Known TTPs

SEO Poisoning
Social Engineering (Brand Impersonation)
Trojanized Software Distribution
DLL Sideloading
Use of Digitally Signed Malware
Credential Harvesting
Malicious Payload Hosting (GitHub)
Persistence via Windows Registry (RunOnce key)

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD