Signalis
sign in--:--:--UTC
Threat actors

Storm-0501

Reports
4
First seen
Feb 19
Last seen
May 19
Motivation
financial, financially motivated

Targeting

Sectors
other ×2

Top ATT&CK techniques

T1036 Masquerading ×2T1566.002 Phishing: Spearphishing Link ×2T1195 Supply Chain Compromise ×1T1550 Use Alternate Authentication Material ×1T1003 OS Credential Dumping ×1T1486 Data Encrypted for Impact ×1T1195.003 Supply Chain Compromise: Compromise Software Supply Chain ×1T1204.001 User Execution: Malicious Link ×1T1598.003 Phishing for Information: Spearphishing Link ×1T1027 Obfuscated Files or Information ×1T1485 Data Destruction ×1T1567 Exfiltration Over Web Service ×1

Indicators

cve ×11filename ×9domain ×5url ×3hash_sha256 ×3hash_sha1 ×2email ×1ip_v4 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26855 (exploited)CVE-2021-26857 (exploited)CVE-2021-26858 (exploited)CVE-2021-27065 (exploited)CVE-2021-43798 (exploited)CVE-2023-2868 (exploited)CVE-2023-3519 (exploited)CVE-2023-7102 (exploited)CVE-2024-3400 (exploited)CVE-2025-0282 (exploited)CVE-2025-61882 (exploited)

Recent reports

Critical

Microsoft disrupts malware-signing-as-a-service operation abused by ransomware gangs

Bleeping ComputerCritical

Exposing Fox Tempest: A malware-signing service operation

Microsoft Threat IntelligenceHigh

Microsoft disrupts Fox Tempest code-signing service used by ransomware groups

CyberScoopHigh

2025 Cloud Threat Hunting and Defense Landscape

Recorded Future Insikt

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans