Storm-1113

Reports per quarter

Techniques seen in the last two years

• T1027 1 report
• T1036.005 1 report
• T1053.003 1 report
• T1059.001 1 report
• T1059.003 1 report
• T1071.001 1 report
• T1082 1 report
• T1140 1 report
• T1203 1 report
• T1204.002 1 report

Counts come from technique IDs in the actor's report text.

CVEs named in reports

• CVE-2021-43890 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   Financially motivated threat actors misusing App Installer | Microsoft Security Blog

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor Financially motivated threat actors misusing App Installer | Microsoft Security Blog

2. 13 June 2025

   GrayAlpha Unmasked: New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor GrayAlpha Unmasked: New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks

3. 13 June 2025

   GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader and NetSupport RAT

4. 21 November 2024

   Untitled

   Malpedia library date fromORKL

   The original link failed its last check. Original publisher Detailsfor Untitled

5. 20 November 2024

   PROSPERO & Proton66: Uncovering the links between bulletproof networks

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor PROSPERO & Proton66: Uncovering the links between bulletproof networks

6. 13 August 2024

   Finding Malware: Unveiling NUMOZYLOD with Google Security Operations

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Finding Malware: Unveiling NUMOZYLOD with Google Security Operations

7. 2 July 2024

   Exposing FakeBat loader: distribution methods and adversary infrastructure

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Exposing FakeBat loader: distribution methods and adversary infrastructure

8. 30 December 2023

   Rewterz Threat Alert - Widely Abused MSIX App Installer Disabled by Microsoft – Active IOCs - Rewterz

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Rewterz Threat Alert - Widely Abused MSIX App Installer Disabled by Microsoft – Active IOCs - Rewterz

9. 12 December 2023

   eSentire-Unraveling_BatLoader_and_FakeBat.pdf

   Malpedia library date fromORKL

   The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor eSentire-Unraveling_BatLoader_and_FakeBat.pdf

10. 28 February 2023

    Malvertising Surges to Distribute Malware

    Malpedia library date fromORKL

    Archived copy on ORKL Detailsfor Malvertising Surges to Distribute Malware

Newest first. Details opens the report in Explore.