Storm-0249 Escalates Ransomware Attacks with ClickFix, Fileless PowerShell, and DLL Sideloading

The threat actor known as Storm-0249 is likely shifting from its role as an initial access broker to a more advanced mix of techniques, including domain spoofing, DLL side-loading, and fileless PowerShell execution to enable ransomware attacks, according to ReliaQuest. These methods are described as helping them bypass defenses, infiltrate networks, maintain persistence, and operate undetected.

The group has been observed deploying ClickFix social engineering to coax targets into running malicious commands via the Windows Run dialog, using curl.exe to fetch a PowerShell script from a URL that mimics a Microsoft domain and then executing it in a fileless manner.

This leads to a malicious MSI package with SYSTEM privileges that drops SentinelOne’s SentinelAgentCore.dll into the AppData folder and the legitimate SentinelAgentWorker.exe, with the aim of sideloading the rogue DLL when the worker process launches and establishing encrypted C2 communication.

ReliaQuest notes the activity also includes living-off-the-land techniques, using reg.exe and findstr.exe to harvest MachineGuid, a move tied to follow-on ransomware campaigns and the monetisation of access by selling to ransomware gangs, with Microsoft having named Storm-0249 as the actor behind these activities. This work marks a shift from mass phishing to precision attacks that weaponise trusted signed processes for stealth, with the end goal of persistent enterprise access.