- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Iran(high confidence)
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0497 · cobalt-aztec
IranWhat it is
Storm-1084 is a threat actor that has been observed collaborating with the MuddyWater group. They have used the DarkBit persona to mask their involvement in targeted attacks. Storm-1084 has been linked to destructive actions, including the encryption of on-premise devices and deletion of cloud resources. They have been observed using tools such as Rport, Ligolo, and a customized PowerShell backdoor. The extent of their autonomy or collaboration with other Iranian threat actors is currently unclear.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- Storm-1084, DEV-1084
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Tools
The tools and malware families the sources tie to it.
- Backdoor.Oldrea
- CloudDuke
- POWERSOURCE
- POWERSTATS
- Power Loader
- PowerDuke
- PowerRAT
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de