Loading story…
Security researchers reported that the Storm botnet evolved beyond spam distribution by automatically retaliating against systems that scanned infected hosts, launching sustained distributed denial-of-service attacks against the source of the probes. Higher-education networks were warned of elevated risk because routine vulnerability and malware scanning could trigger the response, and researchers said the behavior marked an unusual defensive capability for a botnet that had previously been known mainly for mass-mailing campaigns and malware propagation.
At the same time, investigators found Storm’s infrastructure being used in phishing attacks against Barclays and Halifax customers, with spam emails directing victims to fraudulent banking sites designed to steal credentials. Analysts said the campaigns suggested the botnet may have been rented or otherwise made available to other criminals, while Storm’s operators also shifted from earlier email lures toward malicious web pages as defenders improved filtering and user awareness, underscoring the botnet’s adaptability even as some observers questioned whether its momentum was fading.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
After the Barclays campaign was detected, attackers moved to a second phishing campaign targeting Halifax Bank customers using the Storm botnet. Fortinet described the incidents as the first known Storm-enabled attacks against the financial sector and said the spam appeared broadly distributed rather than based on verified customer lists.
Fortinet detected a phishing campaign targeting Barclays customers that used Storm botnet infrastructure, with emails directing victims to a fake i-Barclays site hosted on a Russia-registered domain. The messages claimed the bank was conducting account reviews to reduce fraud and sought to steal login credentials.
Coverage indicated the Storm worm may have 'blown itself out,' suggesting the botnet's earlier growth or effectiveness was waning. This marked a notable assessment that the threat's trajectory might be declining.
Security researchers said Storm operators were moving away from highly successful email lures such as fake e-cards and news alerts toward malicious web pages, reflecting adaptation to better email filtering and increased user awareness. Reports also highlighted concern that the botnet's scale could support major denial-of-service operations.
Researchers reported that the Storm worm botnet had developed an automated defensive capability that identifies systems scanning infected hosts and directs sustained distributed denial-of-service traffic at them. Ren-Isac warned higher-education institutions of elevated risk as schools resumed network scanning activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
informationweek.com
Open sourcesecureworks.com
Open sourceweb.archive.org
Open sourcedarkreading.com
Open sourcetheregister.co.uk
Open sourceweb.archive.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that a new **InterPlanetary Storm** malware variant broadened its reach from earlier Windows and Linux infections to **Mac**, **Android**, and a growing set of **IoT devices**, including Android-based TVs and Linux-based routers. Barracuda estimated the botnet had infected roughly **13,500 systems across 84 countries**, with the highest concentration in Asia, while separate reporting highlighted the malware’s use of the **InterPlanetary File System (IPFS)** and a peer-to-peer architecture to operate in the wild. The Go-based malware spreads through **SSH dictionary attacks** and exposed **Android Debug Bridge (`ADB`)** services, then establishes persistence, updates itself, detects honeypots, kills competing processes, and enables **reverse shell** access for operators. Researchers warned that the botnet’s backdoor access could be repurposed for **DDoS**, **cryptomining**, or other follow-on attacks, underscoring the risk of internet-exposed administrative services and poorly secured embedded devices.
Aug 14, 2026
Threat actors have launched a sophisticated phishing campaign targeting U.S. universities by leveraging the open-source Evilginx framework. At least 18 educational institutions have been affected since April 2025, with attackers using personalized emails containing TinyURL links that redirect to dynamically generated phishing pages. These pages closely mimic student single sign-on portals and employ advanced evasion techniques, such as expiring URLs, wildcard TLS certificates, bot filtering, and JavaScript obfuscation, making detection and mitigation increasingly difficult. The campaign demonstrates the growing accessibility of advanced phishing tools, enabling even unskilled actors to bypass multi-factor authentication and compromise sensitive credentials. Simultaneously, a new phishing kit called Spiderman has emerged on the dark web, targeting customers of major European banks and cryptocurrency platforms. This full-stack kit allows attackers to easily clone login pages for dozens of financial institutions and conduct real-time credential theft across multiple countries. With a large user community and features that facilitate immediate data exfiltration and hybrid fraud operations, Spiderman represents a significant escalation in the scale and efficiency of phishing threats facing the financial sector. Both campaigns highlight the evolving landscape of phishing, where sophisticated toolkits are lowering the barrier to entry for cybercriminals and increasing the risk to organizations worldwide.
Jun 29, 2026
**Storm** is a newly advertised infostealer sold as a subscription-based cybercrime service that steals browser credentials, cookies, refresh tokens, cryptocurrency wallet data, documents, messaging app session data, screenshots, and system information. Reporting indicates it targets **Chromium** and **Gecko**-based browsers, including Chrome, Edge, Firefox, and Waterfox, while also going after services and apps such as **Telegram**, **Discord**, **Binance**, and **Coinbase**. Investigators observed victim logs spanning multiple countries, including India, Brazil, the United States, and the United Kingdom, and a criminal panel showing more than 1,700 log entries. The malware’s distinguishing feature is **server-side decryption**, which allows stolen browser data to be exfiltrated in encrypted form and decrypted on attacker-controlled infrastructure rather than on the victim device. That design reduces endpoint telemetry, helps evade antivirus detection, and reportedly undermines Chrome’s **App-Bound Encryption** protections. Storm also includes automated cookie restoration and the use of geographically matched **SOCKS5** proxies to re-establish authenticated sessions, enabling attackers to bypass password-based defenses and, in some cases, render **MFA** ineffective while accessing SaaS accounts, Microsoft 365, internal tools, and cloud environments.
Jun 29, 2026