Loading threat actor…
Storm-0324 is a financially motivated cybercriminal malware distributor and initial-access broker, with activity overlapping the tracking names TA543 and Sagrid. Active since at least 2016, it obtains access to victim networks through phishing and exploit-kit delivery chains, then transfers that access to other threat actors. Since 2019, it has primarily distributed JSSLoader and handed off access to Sangria Tempest, also known as FIN7, Carbon Spider, and ELBRUS. These handoffs frequently lead to ransomware deployment; Sangria Tempest is a distinct actor rather than an alias of Storm-0324. The group commonly uses invoice- and payment-themed phishing that impersonates services such as DocuSign and QuickBooks. Its delivery chains use SharePoint-hosted compressed archives, malicious JavaScript, Windows Script Files, VBScript, and Microsoft Office documents. It has employed BlackTDS and Keitaro traffic distribution systems, password-protected lure documents, script obfuscation, and exploitation of CVE-2023-21715 to facilitate infection and hinder analysis. Beginning in July 2023, Storm-0324 expanded its delivery activity to Microsoft Teams, sending malicious links and files through external-tenant communications. JSSLoader provides system reconnaissance, information exfiltration, persistence, and remote command execution. Observed implementations collect host and environment information, establish startup-folder persistence, and execute additional scripts and payloads. Storm-0324 has also historically distributed Gozi, Nymaim, TrickBot, Gootkit, Dridex, IcedID, Sage ransomware, and GandCrab ransomware.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
9 malware families attributed to this actor across reporting.
4 additional families tracked in Mallory.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
34 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.