Storm-0835

Executive Summary

Storm-0835, a cybercriminal group identified by Microsoft, operates using the EvilProxy phishing toolkit to target senior executives in U.S. firms across banking, financial services, and manufacturing sectors. Their campaign exploits vulnerabilities on job platforms like Indeed.com for credential harvesting and account takeovers, leveraging reverse proxy techniques to intercept login details and session cookies.

Goals & Targeting

Storm-0835's primary goal appears to be financial gain through credential harvesting and account takeovers. They specifically target senior executives due to their access to sensitive corporate data and high-value accounts in sectors with significant financial stakes. The group's focus on U.S.-based firms suggests a strategic approach to capitalize on the lucrative nature of these industries.

Storm-0835 is a cybercriminal group uncovered by Microsoft, utilizing the EvilProxy phishing toolkit in their attacks. They target high-ranking executives primarily in the United States across sectors such as banking, financial services, insurance, property management, real estate, and manufacturing. Their modus operandi involves sending phishing emails that direct victims to malicious pages via an open redirection vulnerability on Indeed.com. These pages mimic Microsoft's login interface, allowing the attackers to intercept credentials, two-factor authentication codes, and session cookies through EvilProxy, a reverse proxy tool designed for credential harvesting and account hijacking. The group is known to offer their services under a cybercriminal-as-a-service model, recruiting hundreds of customers who pay monthly fees. This business model complicates direct attribution as multiple actors may utilize the same tools。

Key Capabilities

• Phishing campaign orchestration
• Exploitation of open redirection vulnerabilities
• Use of EvilProxy for credential interception
• Reverse proxy techniques
• High-level social engineering

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm-0835 has been observed in an active campaign since July 2023, primarily targeting executives in the U.S. Their campaigns show a high level of organization, using phishing emails and malicious redirects to compromise credentials. The group's services being sold under a cybercriminal-as-a-service model indicates potential widespread adoption of their tools across multiple actors, making long-term tracking difficult. Notable past operations include credential harvesting from financial institutions and real estate companies via EvilProxy.

IOC Patterns

• Spear-phishing emails with links to Indeed.com
• Malicious domains mimicking Microsoft login pages
• Reverse proxy traffic patterns intercepting session data

Recommended Actions

• Implement multi-factor authentication (MFA)
• Conduct regular phishing awareness training for executives
• Monitor network traffic for suspicious activity from known phishing domains
• Secure third-party vendor services like Indeed.com
• Enhance employee training on identifying phishing attempts
• Perform regular risk assessments of sensitive corporate accounts

Suggested Tags