Storm-0324, also identified as DEV-0324, TA543, and Sagrid by various researchers, is a financially motivated cybercriminal group that emerged around 2016. The group primarily functions as an initial access broker, specializing in gaining entry to corporate networks and subsequently selling or transferring this access to other threat actors, most notably the ransomware-as-a-service (RaaS) group Sangria Tempest (also known as FIN7 or Carbon Spider), for deploying ransomware. Initially, Storm-0324's operations relied on email-based phishing campaigns. However, in July 2023, the group significantly evolved its tactics by incorporating Microsoft Teams chats as a new vector for distributing malicious lures. Microsoft assigns 'Storm' names to groups where the origin or identity has not been confirmed with high confidence, indicating Storm-0324’s evasive nature and lack of definitive state-sponsorship attribution.

Aliases del actor

DEV-0324SagridTA543

Actores similares

devmanransomware · 184stormousransomware · 177crimson-sandstormactor · 1Network Devicesactor · 1Compromise Software Dependencies and Development Toolsactor · 1Device Driver Discoveryactor · 1Storm-1811actor · 1Storm-0501apt · 1Dust Stormapt · 1CS FQL: 32. Detect Data Exfiltration via external storage devicesactor · 1