Loading threat actor…
Storm-0485 is a prolific phishing operator associated with large-scale adversary-in-the-middle phishing activity. The actor has been publicly linked to use of the Evilginx phishing framework, which enables theft of credentials, multifactor authentication responses, and authenticated session cookies by proxying victim logins through attacker-controlled infrastructure. This tradecraft allows account compromise even when MFA is enabled and aligns with broader session hijacking operations against cloud identity platforms such as Microsoft 365. Storm-0485 appears to operate as a cybercriminal phishing actor rather than a nation-state espionage group. The actor is notable in reporting for overlap in tooling with other operators, including Russian espionage actors, illustrating how commercially available phishing kits are reused across both criminal and state-linked campaigns. High-confidence public information in the supplied facts is limited, and no corroborated details are provided here on specific victim geography, sector concentration, sub-groups, or ransomware activity directly attributable to Storm-0485.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.