From a4c56efca87901cdaab85189b77c52b174b7ddf0 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Wed, 20 Dec 2023 03:40:25 -0800 Subject: [PATCH] [threat-actors] Add Storm-1283 --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 99b8e7d..97cc4f2 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -13839,6 +13839,16 @@ }, "uuid": "f8054f5b-45e5-4624-b8d0-1b9c30aa084e", "value": "BiBiGun" + }, + { + "description": "Storm-1283 is a threat actor that targeted Microsoft Azure cloud platform. They gained access to user accounts and created OAuth applications using stolen credentials, allowing them to control resources and deploy virtual machines for cryptomining. The targeted organizations incurred significant financial losses ranging from $10,000 to $1.5 million. Storm-1283 utilized compromised accounts and subscriptions to carry out their illicit activities.", + "meta": { + "refs": [ + "https://www.microsoft.com/en-us/security/blog/2023/12/12/threat-actors-misuse-oauth-applications-to-automate-financially-driven-attacks/" + ] + }, + "uuid": "c9ffcc82-f7ac-46ce-9ea2-91e51d14e11b", + "value": "Storm-1283" } ], "version": 296