Storm-1084

Executive Summary

Storm-1084, also known as DEV-1084, is a suspected state-sponsored threat actor linked to the MuddyWater group. They are known for destructive activities such as encrypting on-premise devices and deleting cloud resources. Storm-1084 uses tools like Rport, Ligolo, and custom PowerShell backdoors, suggesting advanced capabilities likely targeting specific sectors with strategic intent.

Goals & Targeting

Storm-1084 likely aims to disrupt or destroy critical infrastructure and gather intelligence through destructive campaigns. Their collaboration with MuddyWater indicates possible alignment with broader Iranian cyber espionage activities targeting Middle Eastern governments and private entities.

Storm-1084 is a moderately sophisticated threat actor with links to the MuddyWater group and has been observed using DarkBit persona to hide their activities. Their primary methods include destructive actions like system encryption and resource deletion, along with employment of custom tools such as Rport remote access tool (RAT), Ligolo information stealer, and PowerShell backdoor. The group's collaboration with other Iranian threat actors is evident but the extent of their operational independence remains unclear. Storm-1084's targeting pattern suggests a focus on strategic sectors potentially aligned with state interests, though specific targets are not fully documented.

Key Capabilities

• Use of custom PowerShell backdoors
• Employment of Rport RAT
• Utilization of Ligolo information stealer
• Spear-phishing attacks with malicious macros
• Credential dumping via windows API
• Lateral movement using PS exec/smb
• Destruction activities (encryption, wiping)

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm-1084 has been involved in campaigns aligned with MuddyWater group, targeting regions possibly in the Middle East or North Africa. Their operations involve long-term access and destructive payloads, suggesting a focus on destabilization or data destruction

IOC Patterns

• Spear-phishing emails with malicious macros
• C2 communication via DNS queries
• Presence of Rport RAT files in system directories
• Unusual PowerShell scripts execution
• Network traffic indicative of lateral movement

Recommended Actions

• Implement robust endpoint detection and response (EDR) solutions
• Monitor network for anomalies related to known C2 patterns
• Conduct regular user training on phishing recognition
• Enforce strong access controls and multi-factor authentication
• Regularly backup critical systems offsite and test recovery processes
• Adopt a proactive incident response plan

Suggested Tags