Loading threat actor…
Storm-3032 is a financially motivated extortion actor assessed to comprise members who splintered from the BlackFile group and now operate under the Helix banner. Its activity overlaps a threat pattern tracked by Google as UNC6671. Storm-3032 has been associated with social-engineering campaigns against corporate Microsoft 365 identities using impersonation of organizational IT help desks and passkey-, MFA-, or single-sign-on-themed lures. Operators use adversary-in-the-middle phishing and device-code phishing to obtain credentials, hijack authenticated sessions, or induce victims to authorize attacker-controlled clients. Following account compromise, they register attacker-controlled MFA methods for persistence, enumerate tenant users, groups, privileges, applications, authentication methods, and cloud resources through Microsoft Graph, and collect documents and email from SharePoint Online, OneDrive for Business, and Exchange Online. Collection is conducted in a throttled manner intended to reduce detection by volume-based controls.
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
18 indicators attributed to this actor. Values are masked here and available in full in Mallory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.