Storm-1747Threat actor
Storm-1747 is an intrusion set that develops and operates the Tycoon 2FA phishing kit, which has been active since at least mid-2023 and is known for its sophisticated obfuscation and exfiltration techniques. The kit has been sold and distributed under the PhaaS model, making it one of the most widespread phishing kits by early 2025.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io2 reports
ATT&CK techniques
6 of 13 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“…unauthorised access into networks and systems, often through phishing attacks, exploitation of vulnerabilities, or compromising Remote Desktop Protocols (RDP).”
- T1059.009Cloud API
“Wire the rule to a workflow that calls the relevant cloud API and the SOC gets seconds-level containment.”
- T1069.003Cloud Groups
“| Permission Groups Discovery: Cloud | T1069.003 | Enumerating directory roles and transitive role assignments |”
- T1078.004Cloud Accounts
“| Valid Accounts: Cloud Accounts | T1078.004 | Stolen tokens used for Graph API access and M365 web app browsing |”
- T1087.004Cloud Account
“| Account Discovery: Cloud Account | T1087.004 | Graph enumeration of user profile, role memberships, contacts |”
- T1098Account Manipulation
“| Account Manipulation: Device Registration | T1098.005 | Kit registers device for PRT persistence |”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cyber Threat Actors Impacting the Financial Sector in 2024“Storm-1747 is an intrusion set that develops and operates the Tycoon 2FA phishing kit since at least mid-2023.”
-
Detecting Tycoon 2FA AiTM attacks across Entra ID and Google Workspace“First observed in August 2023 and attributed to Storm-1747 (per Microsoft Threat Intelligence), the kit provides turnkey adversary-in-the-middle (AiTM) capabilities that bypass multi-factor authentication and steal authenticated session tokens from Microsoft 365 and Google Worksp…”
Indicators in its reports
named in the reports above- sites.google[.]comin 1 report
- okta-revolut[.]comin 1 report
- revolut-okta[.]comin 1 report
- api.ipapi[.]isin 1 report
- token.client[.]idin 1 report
- hxxps://www.google[.]com/accounts/OAuthLoginin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.