Threat actor
Storm-2754
Tracked by CyberSIXT since 7 Apr
- Articlesall time
- 4
- Articleslast 30 days
- 0
- CVEs exploitedattributed · all time
- 0
- Research reportsall time
- 0
4 articles from 4 outlets since 7 Apr; the latest 201 days ago.
- Article
- First report
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 8 Apr · 11:00 UTC | SecurityWeek | US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS Hijacking |
| Tue 7 Apr · 18:11 UTC | The Hacker News | APT28 hijacks routers worldwide in DNS based FrostArmada campaign |
| Tue 7 Apr · 16:01 UTC | Infosecurity | APT28 exploits SOHO routers via CVE‑2023‑50224 to steal credentials |
| Tue 7 Apr · 15:27 UTC | Microsoft | Forest Blizzard hijacks routers to spy via AI enabled DNS attacks |
Who reported 4 outlets
- Microsoft1
- Infosecurity1
- The Hacker News1
- SecurityWeek1
) : ""}
Names and sources
- Storm-2754
- CyberSIXT coverage
- storm2754
- CyberSIXT coverage
MITRE ATT&CK® techniques
No MITRE ATT&CK® techniques are recorded for Storm-2754.
Also mentioned alongside Storm-2754 (not attributed)1 CVE in the same articles
These articles name both the actor and the CVE. They do not attribute exploitation of these CVEs to Storm-2754.
CVE-2023-50224TP-Link TL-WR841N Authentication Bypass by Spoofing VulnerabilityCVSS6.5MediumExploited20%EPSS3articles
- US Disrupts Russian Espionage Operation Involving Hacked Routers and DNS HijackingSecurityWeek
- APT28 hijacks routers worldwide in DNS based FrostArmada campaignThe Hacker News
- APT28 exploits SOHO routers via CVE‑2023‑50224 to steal credentialsInfosecurity
- Forest Blizzard hijacks routers to spy via AI enabled DNS attacksMicrosoft · first in our coverage