Storm-1567

❔ UnknownMotivation: financialLast active: 2026-08-10First seen: 2024-02-20G1024 ↗

linked CVEs

Also known as

AkiraPUNK SPIDERGOLD SAHARAMegazordHowling Scorpius

Targeted industries

Agriculture and Food ProductionBusiness ServicesConstructionConsumer ServicesEnergyFinancial ServicesHealthcareHospitality and TourismManufacturingNot FoundTechnologyTelecommunicationTransportation/Logistics

Targeted regions

ARAUCACHDEESFRGBITJPNJNLQCUS

Storm-1567 is the threat actor behind the Ransomware-as-a-Service Akira. They attacked Swedish organizations in March 2023. This ransomware utilizes the ChaCha encryption algorithm, PowerShell, and Windows Management Instrumentation (WMI). Microsoft's Defender for Endpoint successfully blocked a large-scale hacking campaign carried out by Storm-1567, highlighting the effectiveness of their security solution.

Source: misp_galaxy · Collected: 2026-08-10

⚡ Vulnerabilities & Exploits6 CVEs

threat_actor_cve → cves / exploits.cve_ids

CVE-2025-55182 suspected	A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints. 💥 EDB-52506	CVSS 10.0 KEVransomware
CVE-2024-55591 suspected	An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote attacker to gain super-admin privileges via crafted requests to Node.js websocket module.	CVSS 9.8 KEVransomware
CVE-2024-40766 suspected	SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.	KEVransomware
CVE-2025-32433 suspected	Erlang Erlang/OTP SSH server contains a missing authentication for critical function vulnerability. This could allow an attacker to execute arbitrary commands without valid credentials, potentially leading to unauthenticated remote code execution (RCE). By exploiting a flaw in how SSH protocol messages are handled, a malicious actor could gain unauthorized access to affected systems. This vulnerability could affect various products that implement Erlang/OTP SSH server, including—but not limited to—Cisco, NetApp, and SUSE.	KEV
CVE-2025-33073 suspected	Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate. 💥 EDB-52330	KEV
CVE-2025-7771 suspected	— 💥 EDB-52512

🔍 Detection Coverage2 Sigma

Derived from linked CVEs — not a direct actor match

highvia CVE-2025-55182

Linux Suspicious Child Process from Node.js - React2Shell

linux

highvia CVE-2025-55182

Windows Suspicious Child Process from Node.js - React2Shell

windows

🧬 YaraComing soon

MITRE ATT&CK Techniques Used17 techniques

Across 13 tactics

Collection2 techniques

T1213.002Sharepoint

Adversaries may leverage the SharePoint repository as a source to mine valuable information. SharePoint will often contain useful information for an adversary to learn about the structure and function…

T1560.001Archive via Utility

Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that…

Command And Control1 technique

T1219Remote Access Tools

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a g…

Credential Access1 technique

T1558Steal or Forge Kerberos Tickets

Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable [Pass the Ticket](https://attack.mitre.org/techniques/T1550/003). Kerberos is an authentica…

Defense Impairment1 technique

T1685Disable or Modify Tools

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensor…

Discovery2 techniques

T1018Remote System Discovery

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality…

T1482Domain Trust Discovery

Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. Domain trusts provi…

Execution1 technique

T1059.001PowerShell

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Cit…

Exfiltration1 technique

T1567.002Exfiltration to Cloud Storage

Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a…

Impact3 techniques

T1486Data Encrypted for Impact

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessibl…

T1531Account Access Removal

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed crede…

T1657Financial Theft

Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of t…

Initial Access2 techniques

T1078Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to by…

T1133External Remote Services

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect t…

Lateral Movement1 technique

T1021.001Remote Desktop Protocol

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on…

Persistence2 techniques

T1078Valid Accounts

T1133External Remote Services

Privilege Escalation1 technique

T1078Valid Accounts

Stealth3 techniques

T1027.001Binary Padding

Adversaries may use binary padding to add junk data and change the on-disk representation of malware. This can be done without affecting the functionality or behavior of a binary, but can increase the…

T1036.005Match Legitimate Resource Name or Location

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation…

T1078Valid Accounts

🛰️ Infrastructure & IOCs0

No IOCs linked to this actor yet.

📰 Threat Intel Coverage4

Digest reports mentioning this actor (incl. aliases)

No Manners Here: The Ruthless Rise of The Gentlemen Ransomware	matched as Howling Scorpius	2026-07-10
Tune In: The Future of AI-Powered Vulnerability Discovery	matched as PUNK SPIDER	2026-05-01
Nowhere, man: The 2026 Active Adversary Report	matched as Gold Sahara	2026-02-24
Russian Ransomware Gangs Weaponize Open-Source AdaptixC2 for Advanced Attacks	matched as Akira	2025-10-31