Threat Actor 🇨🇳 China
Storm-0940
Also known as: CovertNetwork-1658 · ORB07
Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks.
Indicators of Compromise 1
MITRE ATT&CK TTPs 24
T1021 T1027 T1046 T1053 T1059 T1059.001 T1071 T1071.001 T1078 T1080 T1082 T1083 T1090 T1095 T1105 T1110 T1210 T1484 T1496 T1556 T1558 T1566 T1594 T1595
Remote Services
Lateral Movement
Obfuscated Files or Information
Defense Evasion
Network Service Discovery
Discovery
Scheduled Task/Job
Execution
Command and Scripting Interpreter
Execution
PowerShell
Execution
Application Layer Protocol
Command And Control
Web Protocols
Command And Control
Valid Accounts
Defense Evasion
Taint Shared Content
Lateral Movement
System Information Discovery
Discovery
File and Directory Discovery
Discovery
Proxy
Command And Control
Non-Application Layer Protocol
Command And Control
Ingress Tool Transfer
Command And Control
Brute Force
Credential Access
Exploitation of Remote Services
Lateral Movement
Domain or Tenant Policy Modification
Defense Evasion
Resource Hijacking
Impact
Modify Authentication Process
Credential Access
Steal or Forge Kerberos Tickets
Credential Access
Phishing
Initial Access
Search Victim-Owned Websites
Reconnaissance
Active Scanning
Reconnaissance