Loading threat actor…
Storm-1607 is a Microsoft-tracked cybercriminal threat cluster associated with large-scale phishing activity and use of the ClickFix social-engineering technique. The actor was observed using ClickFix between March and June 2024 in email campaigns that delivered HTML attachments designed to trick users into manually executing malicious commands, including attempts to install the DarkGate loader. Observed campaigns included high-volume payment- and invoice-themed phishing directed at organizations in the United States and Canada. Storm-1607 has also been linked to campaigns using Lumma Stealer, an infostealer commonly employed by financially motivated actors. Its tradecraft aligns with broad criminal initial-access activity centered on phishing and social engineering rather than exploitation, with delivery chains leveraging fake verification or error-resolution prompts to induce user execution. Reported behaviors directly associated with the cluster support initial access via phishing, use of malware loaders and stealers, and post-compromise data theft objectives consistent with financially motivated cybercrime. Storm-1607 is not identified as a nation-state actor in the available reporting. No corroborated sub-groups or widely used alternate aliases beyond the Microsoft tracking name are established in the supplied facts.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Microsoft-tracked activity cluster described as a ransomware group that has used LummaStealer in campaigns.
Microsoft-tracked threat cluster conducting large-scale phishing/malvertising campaigns using the ClickFix methodology (fake verification/CAPTCHA leading to user-executed commands and multi-stage payload delivery).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.