- Category
- Targeted, sponsor unknown · Targeted intrusions with no sponsor attributed.
- Origin
- Indonesia(high confidence)
- Sources
- 3 sources carry it
- Identifier
- GINC-APT-0970 · storm-1167
IndonesiaWhat it is
Storm-1167 is a threat actor tracked by Microsoft, known for their use of an AiTM phishing kit. They were responsible for launching an attack that led to Business Email Compromise activity.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- DEV-1167
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)Indonesia
- ThreatActor.info (Malpedia et al.)Indonesia
Sources
- Malpedia malpedia.caad.fkie.fraunhofer.de