Storm-2077

Executive Summary

Storm-2077, operating under the aliases TAG‑100 and RedNovember, is a sophisticated cyber‑espionage actor believed to be state‑sponsored, targeting a broad spectrum of government and critical infrastructure sectors worldwide. The group exploits publicly disclosed vulnerabilities in perimeter appliances and leverages open‑source backdoors such as Pantegana and BRICKSTORM, combined with commercial tools like Cobalt Strike, to gain initial footholds and exfiltrate data to cloud storage services.

Goals & Targeting

The primary objective for Storm-2077 is to gather actionable intelligence from sovereign, defense, and industry stakeholders across multiple geographies. By compromising internet‑facing perimeter appliances that often have rich configuration data and privileged network access, the group can pivot laterally into core asset networks. Once inside, they focus on credential harvesting and exfiltration of both structured documents (e.g., procurement contracts, policy files) and unstructured data (emails, communications). Their sector coverage—government, defense, aerospace, utilities, finance, healthcare and more—suggests a broad intelligence mandate likely aimed at enhancing situational awareness for their sponsoring state in geopolitical, economic, or military arenas.

Key Capabilities

• Deploys open‑source tools such as Pantegana
• Employs stealthy backdoor malware like BRICKSTORM for persistence and evasion
• Utilizes SparkRAT and Cobalt Strike for remote access, post‑exploitation, and command-and-control
• Exploits publicly disclosed vulnerabilities in perimeter appliances (Citrix NetScaler, F5 BIG‑IP, Palo Alto GlobalProtect CVE‑2024‑3400, Check Point VPN CVE‑2024‑24919, Microsoft Office Follina CVE‑2022‑30190)
• Conducts port scanning and network reconnaissance against targeted organizations
• Exfiltrates stolen data via cloud storage services (e.g., MEGA)
• Delivers malicious payloads through compromised or typosquatted domains and anonymous file-sharing sites
• Uses malicious Word documents with macros or embedded exploits for delivery

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm‑2077 demonstrates a methodical exploitation cycle: reconnaissance via port scanning, exploitation of known perimeter CVEs, deployment of backdoors and commercial C2 frameworks, lateral movement within target networks, and data exfiltration to public cloud services. Victim selection spans high‑value sectors—including defense, aerospace, utilities, finance, healthcare, education, and telecommunications—across the US, China, Taiwan, South Korea, Great Britain, North Korea, Iran, Israel, and other countries. The group’s activity peaks around political or procurement milestones, suggesting a politically motivated intelligence agenda. Notably, in mid‑2024 they were observed targeting U.S. aerospace firms through IP 209.141.46.57 and later shifting focus to South Korean non‑profits and security agencies by early 2025. Operational tempo is moderately frequent: quarterly bursts of reconnaissance and exploitation are followed by silent data exfiltration windows. The use of open‑source backdoors and commercial C2 infrastructure complicates attribution, yet the consistent pattern of targeting perimeter appliances and exploiting zero‑day or low‑severity CVEs indicates a mature, resource‑rich threat actor. The campaign is currently active; however, precise dates for first and last observed activity are not publicly confirmed. The reliance on widely available tools also suggests that the organization can adapt quickly to new vulnerabilities, maintaining an evolving attack surface.

IOC Patterns

• Domain names pointing to command-and-control or staging sites
• IP addresses of C2 servers and exploitation endpoints
• SHA-256 file hashes for known backdoor executables such as Pantegana and SparkRAT
• URLs containing typosquatted domains used in phishing and malware delivery (e.g., login.offiec.us kg)
• References to CVE identifiers (e.g., CVE‑2022‑30190, CVE‑2024‑3400)

Recommended Actions

• Patch and harden internet-facing perimeter devices (Citrix NetScaler, F5 BIG-IP, Palo Alto GlobalProtect, Check Point VPN) to mitigate known CVEs.
• Apply mitigations for Microsoft Office Follina (CVE‑2022‑30190).
• Block or closely monitor traffic to/from known C2 domains/IPs associated with Pantegana, SparkRAT, Cobalt Strike and BRICKSTORM.
• Implement comprehensive logging and monitoring of public-facing applications and VPN tunnels; detect port-scanning and anomalous remote service connections.
• Segment edge device networks and enforce strict access controls to limit lateral movement from compromised perimeter points.
• Block or filter typosquatted domains (e.g., login.offiec.us kg) and anonymous file-sharing sites used for staging malware.
• Deploy IDS/IPS rules for CVE exploitation signatures, non-standard port activity, and known backdoor binaries.
• Enforce policy against malicious Word documents with macros; employ web filtering to block such content.

Suggested Tags