Storm-2561

Reports: 13
Last reported: 6 April 2026
Known CVEs: 3

ID: storm-2561
Sources: MISP Malpedia Microsoft
Merge evidence: 2 alias matches

Reports per quarter

2016 Q2: 2 reports
2016 Q3: no reports
2016 Q4: 1 report
2017 Q1: 1 report
2017 Q2: 1 report
2017 Q3: no reports
2017 Q4: no reports
2018 Q1: no reports
2018 Q2: no reports
2018 Q3: no reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: no reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: no reports
2022 Q3: no reports
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: no reports
2026 Q1: 1 report
2026 Q2: 7 reports

Dated reports, 2016 Q2 to 2026 Q2.

CVEs named in reports

CVE-2025-10035 KEV ransomware
CVE-2025-55182 KEV ransomware
CVE-2025-66478

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

6 April 2026

Threat intelligence | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog
6 April 2026

Threat actors | Latest Threats | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat actors | Latest Threats | Microsoft Security Blog
6 April 2026

Threat intelligence | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog
6 April 2026

Threat intelligence | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog
6 April 2026

Threat intelligence | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog
6 April 2026

Threat actors | Latest Threats | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat actors | Latest Threats | Microsoft Security Blog
6 April 2026

Threat intelligence | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog
12 March 2026

Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Storm-2561 uses SEO poisoning to distribute fake VPN clients for credential theft
7 June 2017

Threat intelligence | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog
25 January 2017

Threat intelligence | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog

Show all 13 reports Show fewer

9 December 2016

Threat intelligence | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog
9 June 2016

Threat actors | Latest Threats | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat actors | Latest Threats | Microsoft Security Blog
26 April 2016

Threat intelligence | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog

Newest first. Details opens the report in Explore.