ctrlINT What the industry said about every indicator, with the quote

Storm-2561Threat actor

Storm-2561 is a cybercriminal threat actor known for a credential theft campaign that employs SEO poisoning to distribute fake VPN clients. The campaign redirects users to malicious ZIP files containing digitally signed trojans that harvest VPN credentials, leveraging user trust in search engine results.From MISP Galaxy

Last reported 11 days ago, by Huntress1 report

ATT&CK techniques

1 technique · each with the sentence it comes from
  1. T1553.002Code Signing

    “It carries an Authenticode signature from WatchGuard Technologies, Inc., issued by Sectigo Public Code Signing CA R36, with a countersignature timestamp of 4 November 2025.”

    HuntressVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

1 report, newest first · the exact sentence from each

  1. “Microsoft attributed this wider campaign iteration to Storm-2561, a financially motivated actor that has been active since May 2025.”

    HuntressVendor
    Fake WatchGuard VPN Site Steals Credentials

Indicators in its reports

named in the reports above
Copy these 9 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Storm-2561 here?
No account needed. We do not store your IP address.