Storm-2372Threat actor
Storm-2372 is a suspected nation-state actor aligned with Russian interests, engaging in device code phishing campaigns targeting governments, NGOs, and various industries across Europe, North America, Africa, and the Middle East.From MISP Galaxy
Last reported 27 days ago, by CERT-EU4 reports
ATT&CK techniques
6 of 16 · each with the sentence it comes from- T1098.005Device Registration
“…72 reporting, including use of the Microsoft Authentication Broker client ID to obtain refresh tokens that can support downstream device registration and email access.”
- T1195Supply Chain Compromise
“An OAuth supply chain compromise at Vercel exposed how trusted third party apps and platform environment variables can bypass traditional defenses and amplify blast radius.”
- T1036Masquerading
“Attributed to threat actor idbzoomh, the campaign used a malicious archive masquerading as leaked source code to deliver Vidar v18.7, an information stealer, and GhostSocks, a SOCKS proxy trojan.”
- T1078Valid Accounts
“Stage 3: Internal system access (T1078)”
- T1078.004Cloud Accounts
“Stage 5: Potential downstream exploitation (T1078.004)”
- T1087Account Discovery
“T1087”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Cyber Brief 26-05 - April 2026“Previous major campaigns were attributed to Russia-linked Storm-2372 and criminal group Scattered Lapsus$ Hunters.”
-
We Need to Talk About Device Code Phishing“In February 2025, Russian threat actor Storm-2372 used Microsoft Teams meeting invite lures to deliver device code phishing messages, stealing victims’ authenticated sessions.”
-
Inside Kali365, a Device Code Phishing Ecosystem“Along the way, the investigation also surfaced behavior consistent with tactics Microsoft previously described in its Storm-2372 reporting, including use of the Microsoft Authentication Broker client ID to obtain refresh tokens that can support downstream device registration and…”
-
The Vercel Breach: OAuth Supply Chain Attack Exposes the Hidden Risk in Platform Environment Variables“Microsoft's April 2026 publication on AI-enabled device-code phishing (Storm-2372 successor campaigns) documented live threat actors using generative AI for dynamic code generation, hyper-personalized lures, and backend automation orchestration.”
Indicators in its reports
named in the reports above- railway[.]comin 1 report
- context[.]aiin 1 report
- env[.]readin 1 report
- hxxps://outlook.office365[.]com/.defaultin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.