Storm-0249 Abuses EDR Processes in Stealthy Attacks

Storm‑0249, an initial access broker, has shifted from noisy phishing to highly targeted campaigns that are harder to detect, according to ReliaQuest. The group is weaponising endpoint detection and response (EDR) platforms and built‑in Windows utilities to conduct post‑compromise activities, including information gathering, creating command‑and‑control channels, and maintaining persistence.

ReliaQuest notes that they also rely on DLL sideloading and even masquerade a Trojanized DLL as SentinelOne’s EDR component to load malicious code when the legitimate executable runs. In addition, Storm‑0249 has been observed using curl.exe to fetch PowerShell scripts, with the scripts executed in memory to avoid touching the disk.

Such techniques help the attackers bypass signature‑based tools and operate under the radar; defenders are urged to deploy behavioural analytics to flag anomalous DLL loads, implement EDR baselining, and monitor DNS connections to newly created domains. The article also highlights unmonitored AppData and registry hives and the value of LOLBin restrictions, network segmentation, and automated response playbooks in mitigating these threats. December 10, 2025.