על גורם התקיפה

Storm-0506 (DEV-0506) is a financially motivated cybercriminal group operating as a core affiliate within the Black Basta ransomware-as-a-service (RaaS) ecosystem, having switched from deploying Conti ransomware around April 2022. This actor's operational model is distinguished by its strategic reliance on a dynamic network of initial access brokers, showcasing a division of labor common in RaaS operations. Throughout its history, Storm-0506 has leveraged access obtained through various brokers: initially Storm-0450/0464 via Qakbot infections (pre-September 2023), then expanding to include Storm-1674 delivering DarkGate, Pikabot, and IcedID (September 2023), and later employing Storm-1674's Microsoft Teams vishing campaigns (October 2024) and Storm-0569's SEO poisoning leading to BATLOADER and Cobalt Strike (December 2023). Following successful initial compromise, Storm-0506 employs a range of post-exploitation tools, including Cobalt Strike Beacon, SystemBC, and Brute Ratel C4 backdoors, and notably, often utilizes command-and-control (C2) infrastructure established by Storm-0365, indicating close collaboration or shared resources. This actor is characterized by hands-on-keyboard activity, culminating in the deployment of Black Basta ransomware. A resurgence in activity observed in October 2024, directly linked to Storm-1674's vishing, underscores the ongoing and adaptive threat that Storm-0506 represents within the ransomware landscape.

הפניות מהפרופילים ומפרסומי מחקר. ברשומות ללא כותרת מקורית, שם הקישור נגזר מכתובת הפרסום. תאריך מוצג רק כשזמין.

• Microsoft29 ביולי 2024

  ransomware operators exploit esxi hypervisor vulnerability for mass encryption

  לפרסום המקורי
• Microsoft28 בדצמ׳ 2023

  financially motivated threat actors misusing app installer

  לפרסום המקורי
• Microsoft

  malware encyclopedia description

  לפרסום המקורי

קשר, דמיון או חפיפה אינם בהכרח זהות בין הקבוצות. לא נוצרים קשרים רק בגלל כלי משותף או מדינה משותפת.

אין כרגע קשר מתועד לקבוצה אחרת במקורות שנקלטו.