Storm-0381

Executive Summary

Storm-0381 is a Russian cybercrime group linked to distributing Magniber ransomware through malvertising campaigns. Known for targeting financial and healthcare sectors, they pose a significant threat due to their financially motivated activities.

Goals & Targeting

Storm-0381's primary goal is financial gain, achieved through large-scale ransomware campaigns targeting high-value industries such as finance and healthcare. Their focus on these sectors suggests a strategy to maximize the potential for ransom payments due to data sensitivity and critical operations.

Storm-0381 operates as a Russian cybercriminal group specializing in malvertising to deploy Magniber ransomware. Their campaigns typically involve infecting users via malicious ads, leveraging this method to distribute malware across various industries. The group has demonstrated persistence since first observed in late 2019, with ongoing activities primarily aimed at extracting financial gains from targeted sectors.

Key Capabilities

• Malvertising campaigns
• Magniber ransomware deployment
• Use of TrickBot and BazarLoader for initial infections

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm-0381 has conducted prolonged campaigns since late 2019, focusing on EMEA regions. Their operations often involve multi-stage attacks beginning with malware distribution and culminating in ransomware deployment, targeting industries where data is critical and ransoms are likely.

IOC Patterns

• Malicious ad campaigns delivering Magniber
• Hosting domains used for malvertising campaigns
• Communication channels using HTTP(S) or DGA techniques

Recommended Actions

• Implement ad blockers to filter malicious ads
• Monitor network traffic for signs of suspicious scripts and domains
• Patch systems regularly and maintain offline backups

Suggested Tags