Threat actor

Storm-0257

Updated 7 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware5Families

ATT&CK28Techniques

IOCs9Tracked

Motivation: —

Also known asstorm_0257

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

MITRE ATT&CK

Tradecraft

28 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.

12 of 15 tactics39 techniques

= intelligence reports citing the technique

TA0043Reconnaissance1 technique

T1589Gather Victim Identity Information

TA0042Resource Development5 techniques

T1583Acquire Infrastructure

T1583.001Domains

T1583.006Web Services

T1584Compromise Infrastructure

T1586×2Compromise Accounts

T1588Obtain Capabilities

T1588.002Tool

T1608Stage Capabilities

TA0001Initial Access2 techniques

T1078×2Valid Accounts

T1566×4Phishing

T1566.001×2Spearphishing Attachment

T1566.002×3Spearphishing Link

TA0002Execution3 techniques

T1053Scheduled Task/Job

T1053.005Scheduled Task

T1059Command and Scripting Interpreter

T1204User Execution

T1204.002Malicious File

TA0003Persistence2 techniques

T1053Scheduled Task/Job

T1053.005Scheduled Task

T1078×2Valid Accounts

TA0004Privilege Escalation2 techniques

T1053Scheduled Task/Job

T1053.005Scheduled Task

T1078×2Valid Accounts

TA0005Stealth3 techniques

T1027Obfuscated Files or Information

T1027.009Embedded Payloads

T1036Masquerading

T1036.005Match Legitimate Resource Name or Location

T1078×2Valid Accounts

TA0006Credential Access3 techniques

T1056×2Input Capture

T1212Exploitation for Credential Access

T1649Steal or Forge Authentication Certificates

TA0007Discovery3 techniques

T1033System Owner/User Discovery

T1057×2Process Discovery

T1082×2System Information Discovery

TA0009Collection1 technique

T1056×2Input Capture

TA0011Command and Control1 technique

T1071Application Layer Protocol

T1071.001Web Protocols

TA0010Exfiltration1 technique

T1041Exfiltration Over C2 Channel

Arsenal

Associated malware families

5 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

Cobalt StrikeCERT-UA said the malware gathers details including the computer name, operating system version, user account information, and running processes. The agency also warned that compromised systems could later receive a payload linked to the offensive hacking framework Cobalt Strike, a legitimate penetration-testing tool frequently abused by cybercriminals and state-backed groups.2May 22, 2026 OYSTERBLUESThe malware chain ultimately deployed components known as OysterBlues and OysterShuck, which collect system information from infected devices and send it to attacker-controlled infrastructure hidden behind Cloudflare.1May 22, 2026 OYSTERFRESHThe phishing email contained a PDF attachment with a malicious link that downloaded a ZIP archive carrying malware identified as OysterFresh.1May 22, 2026 OYSTERSHUCKThe malware chain ultimately deployed components known as OysterBlues and OysterShuck, which collect system information from infected devices and send it to attacker-controlled infrastructure hidden behind Cloudflare.1May 22, 2026 PicassoLoaderKey developments include the deployment of multiple variants of the group’s main payload downloader, named PicassoLoader by CERT-UA. Variants of this downloader are written in .NET, PowerShell, JavaScript, and C++.1May 15, 2026

Indicators of compromise

Observables

9 indicators attributed to this actor. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

No public activity tracked yet. Mallory keeps watching.

View more in app →

No public activity observed for this threat actor.

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping28Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal5Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEsCVEs this actor has used in known campaigns.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables9Domains, IPs, and hashes tied to this actor, refreshed continuously.

Threat actor

Storm-0257

Updated 7 months ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVEs0Associated

Malware5Families

ATT&CK28Techniques

IOCs9Tracked

Motivation: —

Also known asstorm_0257

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

MITRE ATT&CK

Tradecraft

28 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.

12 of 15 tactics39 techniques

= intelligence reports citing the technique

TA0043Reconnaissance1 technique

T1589Gather Victim Identity Information

TA0042Resource Development5 techniques

T1583Acquire Infrastructure

T1583.001Domains

T1583.006Web Services

T1584Compromise Infrastructure

T1586×2Compromise Accounts

T1588Obtain Capabilities

T1588.002Tool

T1608Stage Capabilities

TA0001Initial Access2 techniques

T1078×2Valid Accounts

T1566×4Phishing

T1566.001×2Spearphishing Attachment

T1566.002×3Spearphishing Link

TA0002Execution3 techniques

T1053Scheduled Task/Job

T1053.005Scheduled Task

T1059Command and Scripting Interpreter

T1204User Execution

T1204.002Malicious File

TA0003Persistence2 techniques

T1053Scheduled Task/Job

T1053.005Scheduled Task

T1078×2Valid Accounts

TA0004Privilege Escalation2 techniques

T1053Scheduled Task/Job

T1053.005Scheduled Task

T1078×2Valid Accounts

TA0005Stealth3 techniques

T1027Obfuscated Files or Information

T1027.009Embedded Payloads

T1036Masquerading

T1036.005Match Legitimate Resource Name or Location

T1078×2Valid Accounts

TA0006Credential Access3 techniques

T1056×2Input Capture

T1212Exploitation for Credential Access

T1649Steal or Forge Authentication Certificates

TA0007Discovery3 techniques

T1033System Owner/User Discovery

T1057×2Process Discovery

T1082×2System Information Discovery

TA0009Collection1 technique

T1056×2Input Capture

TA0011Command and Control1 technique

T1071Application Layer Protocol

T1071.001Web Protocols

TA0010Exfiltration1 technique

T1041Exfiltration Over C2 Channel

Arsenal

Associated malware families

5 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

Indicators of compromise

Observables

9 indicators attributed to this actor. Values are masked here and available in full in Mallory.

View all in app →

Indicator values are available in Mallory. Pivot on every hash, domain, URL, and IP, or pipe them straight into your SIEM.View all in Mallory

Activity feed

Recent activity

No public activity tracked yet. Mallory keeps watching.

View more in app →

No public activity observed for this threat actor.

Are they targeting you?See whether this actor's campaigns touch your sector, your geography, or the products you run, and get alerted when that changes.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what's public. Mallory adds the parts that aren't: whether this actor's tooling has touched your footprint, the IOCs they're burning right now, and the detections to deploy next.

Start Free Trial Open in App ↗

Target overlapMatch sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping28Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal5Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEsCVEs this actor has used in known campaigns.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables9Domains, IPs, and hashes tied to this actor, refreshed continuously.