Loading threat actor…
Storm-2372 is a Russia-aligned cyberespionage threat cluster tracked by Microsoft and active since at least August 2024. It targets organizations of strategic intelligence interest across Europe, North America, Africa, and the Middle East. Its targets include government agencies, defense organizations, non-governmental organizations, healthcare, telecommunications, higher education, information technology, and energy organizations. The cluster specializes in spear-phishing that abuses legitimate Microsoft OAuth device authorization flows to compromise Microsoft 365 accounts. Messaging-themed social engineering and fraudulent Microsoft Teams invitations persuade victims to enter attacker-provided device codes on genuine Microsoft authentication pages. When victims complete authentication, including MFA, they authorize attacker-controlled sessions, allowing the operators to obtain access and refresh tokens without directly stealing passwords. This technique abuses legitimate authentication functionality rather than exploiting a Microsoft software vulnerability. Storm-2372 uses stolen tokens to access cloud resources and exfiltrate email through Microsoft Graph. Its tradecraft also includes Microsoft Authentication Broker token requests and device-registration abuse to support persistent access. Similar device-code phishing techniques have subsequently appeared in commercial phishing frameworks and other threat clusters; technical resemblance alone does not establish that those operations belong to Storm-2372.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
3 malware families Mallory has associated with this actor across public reporting.
16 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.