Storm-0494
Storm-0494 is a threat actor associated with GootLoader/Gootloader intrusions and initial access operations. Microsoft reported that Storm-0494 often takes over from GootLoader infections and provides access to another threat group, Vanilla Tempest. In the reported activity, Storm-0494 infected victim systems with the Gootloader malware downloader, after which follow-on intrusion activity included deployment of the Supper backdoor, also known as SocksShell or ZAPCAT, and use of AnyDesk for remote access. Huntress attributed multiple October 2025 intrusions to Storm-0494 working in partnership with Vanilla Tempest (aka Rhysida), describing Storm-0494 as handling Gootloader operations and initial access before handing victims off for post-exploitation and ransomware deployment. Related reporting states that attack chains involving Storm-0494/GootLoader access have led to ransomware deployments including INC, Rhysida, BlackCat, Zeppelin, and Quantum Locker. The content does not provide additional confirmed aliases for Storm-0494 beyond the name Storm-0494.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Health Care Equipment & Services
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Tradecraft
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operates the initial GootLoader infection/access stage that is later handed off to other actors (e.g., Vanilla Tempest).
Follows GootLoader intrusions to further compromise networks, deploying remote access backdoors and enabling attack chains that often culminate in ransomware deployment.
Operates Gootloader for initial access, then hands off compromised environments to Vanilla Tempest for post-exploitation and ransomware deployment.
Uses Gootloader as an initial access mechanism and brokers/feeds that access to another group (Vanilla Tempest) for follow-on operations leading to ransomware deployment.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.