Signalis
sign in--:--:--UTC
Threat actors

Storm-2561

☆ pin
Reports
4
First seen
May 19, 2026
Last seen
Oct 13, 2026
Motivation
Financial

Relationships

Co-mentioned with Storm-2561 in 2 Signalis reports (co-mention, not confirmed collaboration)×2foxtempestCo-mentioned with Storm-2561 in 2 Signalis reports (co-mention, not confirmed collaboration)×2storm0249Co-mentioned with Storm-2561 in 2 Signalis reports (co-mention, not confirmed collaboration)×2storm0501Reports targeting OtherOtherStorm-2561

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors
Other ×2

Top ATT&CK techniques

T1598 Phishing for Information ×2T1036 Masquerading ×2T1566.002 Phishing: Spearphishing Link ×2T1486 Data Encrypted for Impact ×1T1204.001 User Execution: Malicious Link ×1T1195.003 Supply Chain Compromise: Compromise Software Supply Chain ×1T1566 Phishing ×1T1598.003 Phishing for Information: Spearphishing Link ×1T1027 Obfuscated Files or Information ×1T1204 User Execution ×1T1140 Deobfuscate/Decode Files or Information ×1T1071.001 Application Layer Protocol: Web Protocols ×1

Indicators

domain ×9filename ×3hash_sha256 ×3ip_v4 ×3hash_sha1 ×2url ×2

Indicator values are available on Pro and via the API.

Recent reports

High

Fake WatchGuard VPN Site Steals Credentials via SEO Poisoning

Huntress BlogCritical

Microsoft disrupts malware-signing-as-a-service operation abused by ransomware gangs

Bleeping ComputerCritical

Exposing Fox Tempest: A malware-signing service operation

Microsoft Threat IntelligenceHigh

Microsoft disrupts Fox Tempest code-signing service used by ransomware groups

CyberScoop

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans