Threat actor
Storm-2657
United States · financial
Tracked by CyberSIXT since 9 Oct 2025
- Articles · all time
- 2
- Articles · last 30 days
- 0
- CVEs exploited · attributed
- 0
- Research reports · all time
- 0
Names and sources
- Storm-2657
- Named by CyberSIXT coverage
- Storm-2657
- Named by Malpedia · storm-2657
- Payroll Pirates
- Named by Microsoft · Storm-2657
- Storm-2657
- Named by Microsoft · Storm-2657
- Storm-2657
- Named by MISP Galaxy · f240c6dd-e702-4acb-bfa9-131710f9f8b1
- f240c6dd-e702-4acb-bfa9-131710f9f8b1
- Named by CyberSIXT coverage
Attributed facts
- category
- financial (Microsoft · Storm-2657)
- motivation
- financial (Microsoft · Storm-2657)
- origin
- United States (Microsoft · Storm-2657)
- Payroll Piracy: Hackers Storm-2657 Exploit MFA Flaws to Hijack University Salary Payments via WorkdaySecurityOnline
- Investigating targeted “payroll pirate” attacks affecting US universitiesMicrosoft · first in our coverage