Loading threat actor…
Storm-3121 is a Microsoft-tracked threat cluster associated with initial-access operations that lead to ShinyHunters and Falcon extortion activity. Since at least May 2026, it has been linked to social-engineering campaigns targeting corporate Microsoft 365 identities. Operators impersonate organizational IT help desks through phone calls, SMS, and, in some cases, compromised Microsoft Teams accounts, using urgent passkey, multifactor authentication, or single-sign-on update narratives. The campaigns use adversary-in-the-middle phishing to capture credentials and authenticated sessions, and device-code phishing to induce victims to authorize attacker-controlled clients. Post-compromise activity associated with this intrusion ecosystem includes registration of attacker-controlled MFA methods for persistence, Microsoft Graph-based tenant reconnaissance, and collection of documents and email from SharePoint Online, OneDrive for Business, and Exchange Online. Storm-3121 operates alongside other clusters in the broader extortion ecosystem, including Storm-3032, but Storm-3032 is a distinct cluster linked to BlackFile splinter actors operating under the Helix banner.
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
18 indicators attributed to this actor. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.