Loading threat actor…
Storm-2561 is a financially motivated cybercriminal threat actor tracked by Microsoft and active since at least May 2025. It distributes malware through search engine optimization poisoning and websites impersonating legitimate software vendors, particularly enterprise VPN providers. Its campaigns target users seeking software downloads, including SonicWall NetExtender and Ivanti Pulse Secure clients, and exploit trust in search rankings, familiar branding, and digitally signed installers. Storm-2561 has distributed the Bumblebee loader and trojanized VPN clients carrying credential-stealing malware, including SilentRoute and a Hyrax variant. Observed delivery chains use spoofed download pages and GitHub-hosted archives containing malicious Windows Installer packages. These installers sideload malicious DLLs, execute an in-memory loader, and present convincing VPN sign-in interfaces that capture authentication information. The malware exfiltrates VPN credentials and connection details, accesses stored VPN configuration data, and establishes persistence through Windows RunOnce functionality. After harvesting credentials, some variants display an error and direct victims to genuine VPN software to reduce suspicion. The actor uses digitally signed malicious software to appear trustworthy and evade security controls. It has also used malware signed through Fox Tempest's malware-signing-as-a-service operation, which abused Microsoft Artifact Signing. Microsoft disrupted identified campaign resources by removing malicious GitHub repositories and revoking an abused signing certificate.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
21 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
38 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a comparison to the main WatchGuard phishing incident. Microsoft linked Storm-2561 to an earlier VPN credential-theft campaign involving fake installers and malicious DLLs, followed by redirection to legitimate software. The content does not attribute the current browser-based WatchGuard phishing campaign to Storm-2561.
A financially motivated actor active since May 2025, mentioned as Microsoft's attribution for activity related to a VPN-client impersonation and credential-harvesting campaign. The current malware-free WatchGuard phishing incident is not definitively attributed to Storm-2561; Huntress could not establish whether the same operators controlled both registrations of the lure domain.
Financially motivated actor associated by Microsoft with the broader VPN-themed credential-theft campaign, active since May 2025. The reported October 2026 iteration uses search-engine poisoning and a counterfeit WatchGuard download portal to collect VPN credentials, then delivers an authentic signed installer. Earlier iterations used fake MSI installers containing malicious DLLs and also impersonated F5, Fortinet, SonicWall, and Sophos. The content attributes the broader campaign to Storm-2561 rather than independently establishing attribution of this specific incident.
A financially motivated actor associated with an earlier VPN credential-theft campaign involving spoofed vendor download websites and malicious installers. Microsoft linked it to activity involving watchguard-vpn[.]com. It appears as historical context here; the October incident involving watchguard-vpn[.]net is not explicitly attributed to Storm-2561, and continuity of domain ownership is unconfirmed.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.