Storm-0494Threat actor
Storm-0494 is a threat actor that facilitates Gootloader infections, which are then exploited by groups like Vice Society to deploy tools such as the Supper backdoor, AnyDesk, and MEGA. They utilize RDP for lateral movement and employ the WMI Provider Host to deploy the INC ransomware payload. Microsoft has identified their activities as part of a campaign targeting the U. S. health sector.From MISP Galaxy
Last reported 11 months ago, by Huntress1 report
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1003.003NTDS
“Following persistence establishment, the threat actor used ntdsutil to dump the NTDS.dit database (T1003.003), then compressed it into a ZIP archive, likely staged for exfiltration.”
- T1003.006DCSync
“Subsequently, the threat actor leveraged their existing Domain Admin privileges to perform a DCSync attack.”
- T1021.006Windows Remote Management
“…and 54 minutes after the initial JavaScript execution and reconnaissance activity, the threat actor moved laterally via WinRM (Windows Remote Management) to the Domain Controller.”
- T1053.005Scheduled Task
“Moved from scheduled tasks to Startup folder persistence mechanism and still using Windows 8.3 short filenames”
- T1547.001Registry Run Keys / Startup Folder
“…the initial JavaScript file, approximately 10-20 minutes later, two persistence mechanisms would be created leveraging Startup folder (T1547.001).”
- T1558.003Kerberoasting
“… infection, with Domain Controller compromise achieved in as little as 17 hours through predictable attack patterns: AD enumeration (Kerberoasting, SPN scanning), lateral movement via WinRM, Domain Admin account creation, and potential ransomware preparation (Volume Shadow Copy e…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Gootloader | Threat Detection Overview“Gootloader is known to be used by the threat actor tracked as Storm-0494 by MSTIC.”
Indicators in its reports
named in the reports above- cf44aa11a17b3dad…c9d3d183482ain 1 report
- 103.253.42[.]91in 1 report
- 91.236.230[.]134in 1 report
- 213.232.236[.]138in 1 report
- 146.19.49[.]177in 1 report
- 39d980851be1e111…5435c78f7049in 1 report
- hxxps://cortinaspraga[.]com/in 1 report
- cortinaspraga[.]comin 1 report
- hxxp://cookcountyjudges[.]org/in 1 report
- cookcountyjudges[.]orgin 1 report
- hxxps://x.fybw[.]org/in 1 report
- x.fybw[.]orgin 1 report
- hxxps://jungutah[.]com/in 1 report
- jungutah[.]comin 1 report
- hxxps://influenceimmo[.]com/in 1 report
- influenceimmo[.]comin 1 report
- hxxps://tokyocheapo[.]com/in 1 report
- tokyocheapo[.]comin 1 report
- hxxps://espressonisten[.]de/in 1 report
- espressonisten[.]dein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.