- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(medium confidence)
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0340 · sagrid
RussiaWhat it is
The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- Storm-0324, DEV-0324
- Proofpoint
- TA543
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de