Storm-0494

Executive Summary

Storm‑0494, also known as Vice Society or Storm‑0900, is a financially driven threat actor that blends sophisticated phishing campaigns with multi‑stage delivery chains to infect high‑value sectors such as healthcare, finance and government. The group leverages GootLoader infections, macro‑enabled Excel attachments and third‑party hosting services to deliver backdoors and ransomware families like INC and Rhysida, while routinely exploiting unpatched public‑facing services and default credentials.

Goals & Targeting

The actor’s strategic objectives revolve around monetizing compromised environments through ransomware deployment and optional credential harvesting. By targeting sectors that are both financially critical and willing to pay for restoration or data protection (e.g., healthcare, finance), Storm‑0494 maximizes its leverage. Their geographic spread across Western and Eastern markets illustrates a global reach, while the use of social engineering and third‑party services indicates a low‑maintenance but high‑yield operational model.

Key Capabilities

• Initial Access via macro-enabled Excel phishing attachments
• Social engineering with brand impersonation and email spoofing
• Multi‑stage delivery using redirect chains, third‑party criminal services, Amazon S3 cloud hosting
• Provision of initial access through GootLoader infections
• Exploitation of unpatched public‑facing services and default privileged credentials
• Credential dumping via ntdsutil on NTDS.dit files
• Persistence through startup folder entries, scheduled tasks, registry modifications
• Defense evasion by clearing event logs and deleting registry keys
• Data exfiltration via compressed ZIP archives
• Deployment of backdoor loaders such as Tsundere Bot, Vanilla Tempest, OysterLoader (CleanUpLoader/Broomstick)
• Exploitation of CVE-2025‑55182 (React2Shell) to deliver Linux backdoors

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm‑0494 follows a structured, multi‑stage operational pattern: initial compromise via macro phishing and GootLoader deployment, followed by lateral movement using RDP and WMI Provider Host. The actor frequently leverages third‑party criminal services and cloud hosting to obfuscate delivery paths and reduce detection risk. Victim organizations tend to be high‑profile entities capable of paying ransoms or providing valuable data. Recent campaigns have targeted the U.S. healthcare sector with INC Ransomware, while also expanding reach to Germany, Australia and India. The group’s operational tempo appears moderate – campaigns launch quickly once vulnerabilities are identified but rely on established backdoor loaders for persistence. Notable past operations include a U.S. media‑company breach employing GootLoader to drop Tsundere Bot, followed by deployment of Rhysida ransomware; and a European financial institution attack that leveraged the React2Shell vulnerability to infiltrate Linux assets.

IOC Patterns

• domain
• file
• ip-v4
• url
• hash-sha256
• redirect chains to obscure final payload
• third‑party criminal services in delivery
• Amazon S3 URLs for hosting payloads
• Blogspot domains used as lures
• ZIP archive exfiltration patterns
• clearing Windows event logs
• deleting registry keys (terminal server client connections)

Recommended Actions

• Implement email security controls and policy enforcement to detect/block macro‑enabled phishing attachments
• Enable macro protection or disable macros in Microsoft Office apps across the enterprise
• Apply timely patches for public‑facing services and remove default privileged accounts
• Deploy URL reputation filtering, with special attention to AWS S3, Blogspot and other known malicious domains
• Sandbox or analyze suspicious landing pages behind redirects
• Enforce DMARC/SPF/DKIM anti‑spoofing controls to mitigate brand impersonation attempts
• Monitor for startup folder entries, scheduled tasks and registry changes indicative of persistence
• Block known backdoor loaders (Tsundere Bot, Vanilla Tempest, OysterLoader) through signature or behavioral detection
• Restrict privileged access to NTDS files; enforce least‑privilege principles to prevent credential dumping

Suggested Tags