Storm-1977

Executive Summary

Storm‑1977 is a financially motivated threat actor that targets cloud tenants, primarily in the education sector, using password‑spraying and the AzureChecker.exe CLI tool to compromise containers and deploy cryptocurrency mining operations. The group leverages guest account privileges to create new resource groups within compromised subscriptions, while employing sophisticated credential theft and persistence techniques to maintain footholds.

Goals & Targeting

The primary objective of Storm‑1977 appears to be the covert deployment of cryptocurrency mining operations across highly valuable cloud infrastructures. By compromising education, financial, non‑profit, defense, mining, energy, government, think‑tank and media tenants—especially in Israel, Italy, Russia, North Korea, and India—the group seeks high‑yield workloads that can generate significant passive income while maintaining a low attack surface through guest account exploitation.

Key Capabilities

• Password spraying against cloud tenant accounts
• Exploitation of AzureChecker.exe CLI tool for initial infection
• Compromise of subscriptions via guest account to create new resource groups
• Deployment of cryptocurrency mining in compromised containers
• Archiving collected data using libraries or utilities
• Forging Kerberos golden/silver tickets for persistence and lateral movement
• Kerberoasting to harvest service principal names and credentials
• LSA authentication package persistence via registry/LSASS DLL load
• Browser session hijacking through privilege elevation and thread injection
• Remote execution/persistence using Windows BITS jobs, Office macro templates, or default file association hijacks
• Unauthorized modification of network firewall rules
• Copy‑paste code injection attack vectors
• Malicious file download/open chain leading to arbitrary payload deployment
• Container image pull/run anomalies (privileged pulls into compromised environments)
• Package manager misuse for installing malicious libraries
• Persistence via Print Processor DLLs

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm‑1977 has been observed conducting repeated, high‑volume password‑spraying campaigns against Azure tenants since at least early 2023, achieving a breach rate within hundreds of accounts in targeted organizations. The actor systematically escalates privileges by leveraging guest account permissions to create new resource groups, which enables long‑term cryptomining while bypassing basic security controls that monitor only user accounts. Victims span diverse sectors—particularly education and finance—but the group also infiltrates government, defense and energy cloud environments, suggesting operational reach beyond a single industry focus. Operations show rapid deployment (within minutes of initial access) and high persistence scores due to the use of container‑level persistence primitives and LSA package abuse. Notable previous campaigns include an unnamed operation that compromised at least 200+ containers across multiple tenants in Israel and Russia, as well as a later incident targeting Italian finance services where the actor extracted extensive credentials through Kerberoasting before deploying mining workloads. The consistent pattern of guest‑account exploitation combined with advanced credential forging points to a coordinated infrastructure team rather than individual opportunists. Overall, the threat actor appears to operate at a fairly high tempo, maintaining multiple simultaneous infection vectors and focusing on cloud resource elasticity as a stealth mechanism for money generation.

IOC Patterns

• Domain names associated with the actor (e.g., TEMP.Zagros, TEMP.Periscope, tcpdump101.com)
• Executable files that indicate persistence or payload delivery (mavinject.exe, SyncAppvPublishingServer.vbs, PubPrn.vbs, sdbinst.exe, spoolsv.exe, InstallUtil.exe, control.exe, CMSTP.exe, hh.exe)
• Suspicious system component names or usage patterns

Recommended Actions

• Implement continuous monitoring for archive collection via libraries/utilities (T1560.*).
• Deploy detection and alerting for forged Kerberos tickets (golden/silver) and Kerberoasting attempts.
• Set up integrity checks and monitoring for LSA authentication package DLL loads to detect LSASS persistence.
• Configure BITS jobs, Office macro templates, and default file association hijacking alerts with strict whitelist policies.
• Enforce firewall rule change auditing and alert suspicious modifications initiated from within cloud environments.
• Restrict and monitor copy‑paste operations in browsers and email clients to prevent injected code execution.
• Apply rigorous scanning and sandboxing for any downloaded or opened files before execution, especially .exe and .vbs payloads.
• Implement anomaly detection on container image pull/run activity, flagging privileged or unfamiliar image sources.
• Audit package manager usage and block installation of unknown or malicious libraries.
• Remove or quarantine Print Spooler DLl persistence modules found in compromised containers.

Suggested Tags