Signalis
sign in--:--:--UTC
Threat actors

Storm-0249

☆ pin
Reports
4
First seen
Jan 5, 2026
Last seen
May 19, 2026
Motivation
Financial

Relationships

Co-mentioned with Storm-0249 in 2 Signalis reports (co-mention, not confirmed collaboration)×2foxtempestCo-mentioned with Storm-0249 in 2 Signalis reports (co-mention, not confirmed collaboration)×2storm0501Co-mentioned with Storm-0249 in 2 Signalis reports (co-mention, not confirmed collaboration)×2storm2561Reports targeting OtherOtherStorm-0249

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Other ×2

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×2T1566.002 Phishing: Spearphishing Link ×2T1036 Masquerading ×2T1485 Data Destruction ×1T1204.001 User Execution: Malicious Link ×1T1498 Network Denial of Service ×1T1598.003 Phishing for Information: Spearphishing Link ×1T1195.003 Supply Chain Compromise: Compromise Software Supply Chain ×1T1566 Phishing ×1T1027 Obfuscated Files or Information ×1T1003 OS Credential Dumping ×1T1195 Supply Chain Compromise ×1

Indicators

cve ×6filename ×3hash_sha256 ×3domain ×2hash_sha1 ×2

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2020-12812 (exploited)CVE-2025-14174 (exploited)CVE-2025-43529 (exploited)CVE-2025-55182 (exploited)CVE-2025-59718 (exploited)CVE-2025-59719 (exploited)

Recent reports

Critical

Microsoft disrupts malware-signing-as-a-service operation abused by ransomware gangs

Bleeping ComputerCritical

Exposing Fox Tempest: A malware-signing service operation

Microsoft Threat IntelligenceHigh

Microsoft disrupts Fox Tempest code-signing service used by ransomware groups

CyberScoopHigh

Cyber Brief December 2025: Espionage, Ransomware, and Infrastructure Attacks Across Europe and Beyond

CERT-EU Threat Intel

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans