Storm-1674

Executive Summary

Storm-1674 is an access broker leveraging phishing campaigns to distribute DarkGate malware, often through malicious Teams messages with ZIP attachments containing LNK files. Their recent activity includes handoffs to ransomware operators deploying Black Basta, indicating a shift towards more direct financial gain.

Goals & Targeting

Storm-1674's primary objective is likely financial gain through access brokering and facilitating ransomware deployments. They target sectors with valuable data or infrastructure, such as healthcare, education, and technology, particularly focusing on English-speaking regions due to the use of Teams communication channels. Their targeting profile suggests they seek high-value victims that can be exploited for long-term access or direct financial gain through ransomware.

Storm-1674 operates as an access broker specializing in phishing campaigns that exploit Microsoft Teams communication channels. They are known to distribute DarkGate malware, often through malicious attachments such as ZIP files containing LNK files that execute the payload once opened by victims. This approach has been observed in multiple campaigns targeting organizations globally. In September 2023, Storm-1674 facilitated a handoff between an access broker and ransomware operators, leading to the deployment of Black Basta ransomware. Their operational focus appears to be on compromising systems with potential value for ransomware groups, suggesting a strategic partnership model in their attacks.

Key Capabilities

• Phishing campaigns using Microsoft Teams as a communication vector
• Deployment of DarkGate malware via malicious LNK files
• Handoffs with ransomware operators for financially motivated attacks
• Use of publicly available tools like TeamsPhisher for phishing

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm-1674 has demonstrated campaign patterns involving phishing over Teams, with a notable instance in September 2023 where they facilitated Black Basta deployment. Their victims have been observed primarily in sectors with high data value, such as healthcare and education. The group appears to maintain operational persistence while evolving their strategies to align with ransomware operators' demands.

IOC Patterns

• Phishing messages sent via Microsoft Teams requesting verification of documents or action
• ZIP file attachments containing LNK files
• Use of HTTP/DNS communication channels for command-and-control (C2)
• Inclusion of DarkGate and Pikabot malware

Recommended Actions

• Monitor Microsoft Teams communications for suspicious phishing attempts related to document verification.
• Implement endpoint detection rules to flag execution of LNK files outside expected workflows.
• Conduct regular phishing awareness training among employees to mitigate social engineering risks.
• Review and update ZIP file handling policies to minimize exposure to malicious payloads.

Suggested Tags