GINC-APT-0581 · Tracked, unattributed

Storm-1283

Category
Tracked, unattributed · A vendor’s working cluster, not yet attributed.
Origin
Unknown
Sources
4 sources carry it
Identifier
GINC-APT-0581 · storm-1283

What it is

Storm-1283 is a threat actor that targeted Microsoft Azure cloud platform. They gained access to user accounts and created OAuth applications using stolen credentials, allowing them to control resources and deploy virtual machines for cryptomining. The targeted organizations incurred significant financial losses ranging from $10,000 to $1.5 million. Storm-1283 utilized compromised accounts and subscriptions to carry out their illicit activities.

Tools

The tools and malware families the sources tie to it.

  • CloudDuke
  • RIPTIDE

Sources

  • Malpedia malpedia.caad.fkie.fraunhofer.de