Storm-1167Threat actor
- dev-1167
Storm-1167 is a threat actor tracked by Microsoft, known for their use of an AiTM phishing kit. They were responsible for launching an attack that led to Business Email Compromise activity.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1114.003Email Forwarding Rule
“They may also create email forwarding rules that automatically redirect incoming messages to an attacker controlled email address, enabling continued information gathering even after the victim resets their account.”
- T1195Supply Chain Compromise
“Moreover, the interconnected nature of the financial ecosystem amplifies the risks of supply chain compromises.”
- T1213.005Messaging Applications
“Additionally, we observed the use of secured messaging applications like Signal, Session, SimpleX, and Tox for similar purposes, although far less popular.”
- T1684Social Engineering
“The following section outlines the typical approaches used by attackers, from social engineering lures to Business Email Compromise (BEC) attacks.”
- T1684.002Email Spoofing
“These features may include proxy servers rotation, obfuscation of attachments, and email spoofing.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Global analysis of Adversary-in-the-Middle phishing threats“According to this methodology, the most widespread phishing kits are Tycoon 2FA, Storm-1167, NakedPages, Sneaky 2FA, EvilProxy, and Evilginx.”
-
Cyber Threat Actors Impacting the Financial Sector in 2024“Based on Sekoia data, the most prevalent phishing-related threats as of early 2025 include Tycoon 2FA, NakedPages, Sneaky 2FA, Storm-1167 and Evilginx.”
Indicators in its reports
named in the reports above- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
Copy these 2 indicators · defanged
Thanks — we review every report.