Threat actor
Storm-2561
Tracked by CyberSIXT since 12 Mar
- Articles · all time
- 4
- Articles · last 30 days
- 0
- CVEs exploited · attributed
- 0
- Research reports · all time
- 0
4 articles from 4 outlets since 12 Mar; the latest 223 days ago.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Mon 16 Mar · 12:45 UTC | SecurityWeek | Threat Actor Targeting VPN Users in New Credential Theft Campaign |
| Sat 14 Mar · 13:04 UTC | Security Affairs | Storm-2561 lures victims to spoofed VPN sites to harvest corporate logins |
| Fri 13 Mar · 15:09 UTC | The Hacker News | Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal Credentials |
| Thu 12 Mar · 18:47 UTC | Microsoft | Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft |
Who reported 4 outlets
- Microsoft1
- The Hacker News1
- Security Affairs1
- SecurityWeek1
Names and sources
- Storm-2561
- Named by CyberSIXT coverage
- 7ff63e0c-2345-4282-b4d7-0e5dc49dfc60
- Named by CyberSIXT coverage
- Threat Actor Targeting VPN Users in New Credential Theft CampaignSecurityWeek
- Storm-2561 lures victims to spoofed VPN sites to harvest corporate loginsSecurity Affairs
- Storm-2561 Spreads Trojan VPN Clients via SEO Poisoning to Steal CredentialsThe Hacker News
- Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theftMicrosoft · first in our coverage