storm-2755

Executive Summary

Storm‑2755 is a financially motivated threat actor targeting Microsoft 365 users via sophisticated phishing and adversary‐in‐the‐middle techniques. The campaign focuses on payroll, HR and finance personnel across sectors in the United States, Canada, and parts of Europe, using stolen sessions to bypass MFA and alter direct deposit information.

Goals & Targeting

The actor’s strategic objective is financial gain through payroll fraud and direct deposit diversion. By targeting organizations with complex Microsoft 365 environments, Storm‑2755 exploits the dependency on cloud services for payroll processing. The use of geographic filtering (e.g., Canadian users) suggests a focus on jurisdictions where regulatory scrutiny may be lower or where victims are more likely to fall for social engineering. Overall, its profile aligns with financially driven, credential‑based threat actors that prioritize high‑value payroll targets.

Key Capabilities

• Credential harvesting via malicious login page
• Adversary-in-the-middle session hijacking using stolen tokens
• Token replay for persistence without MFA prompts
• Social engineering emails to manipulate payroll instructions
• Geographic filtering targeting Canadian users
• SEO poisoning and malvertising delivery of phishing pages
• Email inbox rule creation for message suppression
• Session renewal outside business hours to avoid detection
• Manual modification of SaaS payroll information

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm‑2755 exhibits a disciplined operational tempo, with repeated automated sign‑ins at regular intervals and the use of residential proxies to maintain persistence. The actor specifically targets payroll, HR and finance users across a wide geographical footprint—primarily North America but also parts of Europe—indicating an opportunistic selection of organizations with high-value financial processes. Its techniques mirror those observed in other Microsoft‑tracked phishing clusters, suggesting either collaboration or shared methodology within the broader adversary ecosystem.

IOC Patterns

• Session cookie theft and replay
• MFA bypass through authentication token reuse
• Malicious sign-in page mimicking Microsoft 365
• Non-interactive OfficeHome sign-ins every ~30 minutes
• Creation of inbox rules that move emails containing keywords 'direct deposit' or 'bank' to hidden folder
• Automatic session renewal around 5:00 AM to prevent re‑authentication during business hours

Recommended Actions

• Implement phishing-resistant MFA such as FIDO2/WebAuthN and block legacy authentication protocols
• Revoke active or anomalous session tokens to terminate hijacked sessions promptly
• Investigate suspicious non-interactive sign-ins, especially those occurring outside business hours
• Mitigate malvertising and SEO poisoning by filtering search results and blocking known malicious domains
• Train users on recognizing direct deposit email spoofing and payroll manipulation scams
• Enforce device compliance through Conditional Access policies
• Deploy SIEM monitoring with baselines to detect anomalous activity patterns
• Configure Microsoft Defender to automatically disrupt suspected attacks and revoke tokens in real time
• Audit OAuth third-party applications to prevent persistence via integrated services
• Run regular phishing simulation campaigns to maintain user awareness

Suggested Tags