Storm-0249

Storm-0249 is a financially motivated cybercriminal threat actor tracked by Microsoft as an initial access broker active since 2021. Microsoft states the actor is known for distributing at minimum BazaLoader, IcedID, Bumblebee, Emotet, Latrodectus, and Brute Ratel C4 (BRc4), and for brokering network access to ransomware operators. Reporting describes Storm-0249 as having evolved from large-scale or mass-phishing activity into more targeted and stealthier campaigns that prepare victim environments for follow-on ransomware attacks. Observed delivery and access methods directly mentioned in the source material include tax-themed phishing, fake DocuSign flows, compromised legitimate websites, malvertising, SEO poisoning, fake ads, and ClickFix social engineering. Microsoft attributed spring 2025 Latrodectus campaigns, including IRS-themed phishing and fake Windows 11 Pro download sites, to Storm-0249. Microsoft also reported that beginning in March 2025, Storm-0249 shifted from traditional email delivery to compromising legitimate websites, potentially via WordPress vulnerabilities, and using ClickFix to deliver Latrodectus or other initial access malware. The actor is specifically described as abusing trusted endpoint detection and response components and built-in Windows utilities to stealthily load malware, establish persistence, and support ransomware operators. Multiple reports state that Storm-0249 weaponized legitimate EDR processes, including SentinelOne components, for DLL sideloading, and used Windows utilities such as curl.exe and fileless PowerShell execution to blend with normal activity and evade detection. Source material also states Storm-0249 used malicious MSI installers with elevated privileges and leveraged sideloaded DLLs for command-and-control, reconnaissance, and persistence. Storm-0249 is also linked by Microsoft to Fox Tempest’s malware-signing-as-a-service ecosystem. Microsoft states that Storm-0249 was among the threat actors that used Fox Tempest-signed malware in active intrusions, alongside Vanilla Tempest, Storm-0501, and Storm-2561. Fox Tempest-signed malware was reported as being delivered through malvertising, SEO poisoning, and fake ads, and associated downstream activity included ransomware and malware families such as Oyster, Lumma Stealer, Vidar, Rhysida, Akira, INC, Qilin, and BlackByte. Known alias directly provided in the content: storm_0249.