threat actor · China
Storm Cloud
On record in MISP Galaxy
Sources name this actor but link nothing to it yet: no CVE, technique or software is on record.
Storm Cloud is a Chinese espionage threat actor known for targeting organizations across Asia, particularly Tibetan organizations and individuals. They use a variety of malware families, including GIMMICK and GOSLU, which are feature-rich and multi-platform. Storm Cloud leverages public cloud hosting services like Google Drive for command-and-control channels, making it difficult to detect their activities.
Source: MISP Galaxy. MISP Galaxy threat-actor cluster, by the MISP Project (CC0 1.0).
- Origin
- China
- On record in
- MISP Galaxy
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.