Storm-2657

Also reported as Payroll Pirates. Linked to United States by one source.

Reports: 4
Last reported: 6 April 2026
Known CVEs: 2
Origin: United States

ID: storm-2657
Sources: MISP Malpedia Microsoft
Merge evidence: 2 alias matches

Reports per quarter

2017 Q4: 1 report
2018 Q1: no reports
2018 Q2: no reports
2018 Q3: no reports
2018 Q4: no reports
2019 Q1: no reports
2019 Q2: no reports
2019 Q3: no reports
2019 Q4: no reports
2020 Q1: no reports
2020 Q2: no reports
2020 Q3: no reports
2020 Q4: no reports
2021 Q1: no reports
2021 Q2: no reports
2021 Q3: no reports
2021 Q4: no reports
2022 Q1: no reports
2022 Q2: no reports
2022 Q3: no reports
2022 Q4: no reports
2023 Q1: no reports
2023 Q2: no reports
2023 Q3: no reports
2023 Q4: no reports
2024 Q1: no reports
2024 Q2: no reports
2024 Q3: no reports
2024 Q4: no reports
2025 Q1: no reports
2025 Q2: no reports
2025 Q3: no reports
2025 Q4: 1 report
2026 Q1: no reports
2026 Q2: 2 reports

Dated reports, 2017 Q4 to 2026 Q2.

CVEs named in reports

CVE-2025-55182 KEV ransomware
CVE-2025-66478

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

6 April 2026

Microsoft Defender for Cloud Apps Archives | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Microsoft Defender for Cloud Apps Archives | Microsoft Security Blog
6 April 2026

Threat intelligence | Microsoft Security Blog

date ORKL added it fromORKL

Archived copy on ORKL Detailsfor Threat intelligence | Microsoft Security Blog
9 October 2025

Investigating targeted “payroll pirate” attacks affecting US universities | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Investigating targeted “payroll pirate” attacks affecting US universities | Microsoft Security Blog
4 December 2017

Microsoft Defender for Cloud Apps Archives | Microsoft Security Blog

Malpedia library date fromORKL

Archived copy on ORKL Detailsfor Microsoft Defender for Cloud Apps Archives | Microsoft Security Blog

Newest first. Details opens the report in Explore.