Storm-1044

Executive Summary

Storm-1044 is a cyber threat actor collaborating with Twisted Spider, targeting endpoints through DanaBot for initial access, lateral movement via RDP, and deploying CACTUS ransomware. Their malvertising campaigns distribute malware leading to ransomware deployment, detected by Microsoft.

Goals & Targeting

Storm-1044's primary goal is likely financial gain through ransomware activity. Targeting sectors with high payouts, such as finance and healthcare, they exploit human error and system vulnerabilities to compromise endpoints and deploy CACTUS ransomware.

Storm-1044 operates in collaboration with Twisted Spider, focusing on strategic cyberattacks using the DanaBot IAT for initial access. They employ lateral movement via RDP, enabling subsequent deployment of CACTUS ransomware by their partners. Their campaigns involve malvertising attacks detected by Microsoft, indicating significant malware distribution efforts.

Key Capabilities

• Initial Access Trojan (IAT): DanaBot
• Lateral Movement via RDP Sign-ins
• CACTUS Ransomware Deployment
• Malvertising Campaigns

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm-1044's attacks are part of an ongoing campaign, with collaborative efforts enhancing their operational reach. Targeting organizations via malvertising and IAT deployment, they have been detected by Microsoft but specific targets remain unclear.

IOC Patterns

• Malicious links in malvertising campaigns
• DanaBot infection signatures on endpoints
• CACTUS ransomware payloads detection
• RDP sign-in attempts from high-numbered ports

Recommended Actions

• Monitor and restrict external RDP access points.
• Enhance ad network monitoring for suspicious domains.
• Implement multi-layer security defenses around endpoints.
• Regularly test backup processes to ensure data integrity.
• Educate users on avoiding malicious phishing links.
• Conduct proactive threat hunting for known IATs and ransomware.

Suggested Tags