Skip to content

CyberSIXT Search

Threat actor

Storm-0249

Tracked by CyberSIXT since 9 Dec 2025

Articles · all time: 3
Articles · last 30 days: 0
CVEs exploited · attributed · all time: 0
Research reports · all time: 0

Three articles so far, 9 Dec 2025 to 15 Dec 2025.

Tue 9 Dec 2025 · first reportStorm-0249 Escalates Ransomware Attacks with ClickFix, Fileless PowerShell, and DLL SideloadingThe Hacker News
Wed 10 Dec 2025Storm-0249 Abuses EDR Processes in Stealthy AttacksDark Reading
Mon 15 Dec 2025Storm-0249 Abuses EDR Process via DLL Sideloading to Cloak Ransomware AccessSecurityOnline

See the full timeline

Names and sources

Storm-0249: Named by CyberSIXT coverage
DEV-0249: Named by Malpedia · storm-0249
Storm-0249: Named by Malpedia · storm-0249
Storm-0249: Named by Microsoft · Storm-0249
DEV-0249: Named by MISP Galaxy · 26c8deca-ac6e-4a56-93bd-5c47d9360b0d
Storm-0249: Named by MISP Galaxy · 26c8deca-ac6e-4a56-93bd-5c47d9360b0d
26c8deca-ac6e-4a56-93bd-5c47d9360b0d: Named by CyberSIXT coverage

Attributed facts

category: in_development (Microsoft · Storm-0249)

Malware and tools

GootLoader (Malpedia · storm-0249)

Coverage

3 articles, all timeFull timeline RSS feed

15 Dec 2025Storm-0249 Abuses EDR Process via DLL Sideloading to Cloak Ransomware AccessSecurityOnline
10 Dec 2025Storm-0249 Abuses EDR Processes in Stealthy AttacksDark Reading
9 Dec 2025Storm-0249 Escalates Ransomware Attacks with ClickFix, Fileless PowerShell, and DLL SideloadingThe Hacker News · first in our coverage

Learn more