Loading threat actor…
Storm-0494 is a financially motivated cybercriminal initial-access actor closely associated with GootLoader intrusions and follow-on ransomware activity. The group is tracked as an operator that compromises victims through GootLoader infections and then hands off access to downstream ransomware actors, most notably Vanilla Tempest, also known as Vice Society and later associated with Rhysida. Storm-0494 has been observed infecting victim environments with the GootLoader malware downloader and enabling subsequent deployment of remote-access tooling and ransomware. The actor’s operations are tied to SEO-poisoning-driven infection chains and compromised web infrastructure used to deliver GootLoader. After initial compromise, Storm-0494 has been linked to deployment of the Supper backdoor, also known as SocksShell or ZAPCAT, and use of legitimate remote-access software such as AnyDesk. Reported post-compromise activity in Storm-0494-linked chains includes rapid hands-on-keyboard intrusion, reconnaissance, persistence, lateral movement using Remote Desktop Protocol, Windows Remote Management, and WMI-based execution, as well as privileged account creation and domain controller compromise. In observed cases, these intrusions progressed quickly from initial infection to enterprise-wide compromise and ransomware deployment. Storm-0494 functions primarily as an access broker or intrusion-enablement actor within a broader criminal ecosystem rather than as the ransomware brand itself. Its activity has been directly connected to attack chains culminating in deployment of ransomware families including INC, Rhysida, BlackCat, Zeppelin, and Quantum Locker by partner or downstream actors. High-confidence reporting specifically links Storm-0494-enabled access to attacks against U.S. healthcare organizations through handoff to Vanilla Tempest. The actor is therefore best understood as a key initial-access and post-exploitation facilitator in ransomware operations centered on GootLoader-derived compromise.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operates the initial GootLoader infection/access stage that is later handed off to other actors (e.g., Vanilla Tempest).
Follows GootLoader intrusions to further compromise networks, deploying remote access backdoors and enabling attack chains that often culminate in ransomware deployment.
Operates Gootloader for initial access, then hands off compromised environments to Vanilla Tempest for post-exploitation and ransomware deployment.
Uses Gootloader as an initial access mechanism and brokers/feeds that access to another group (Vanilla Tempest) for follow-on operations leading to ransomware deployment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.