Storm-2603
Also known as Gold Salem
Reports
6
First seen
Dec 3, 2025
Last seen
Jul 2, 2026
Motivation
Financial
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Top ATT&CK techniques
T1486 Data Encrypted for Impact ×6T1598 Phishing for Information ×3T1078 Valid Accounts ×3T1219 Remote Access Software ×3T1190 Exploit Public-Facing Application ×3T1021.001 Remote Services: RDP ×3T1005 Data from Local System ×3T1136 Create Account ×3T1566 Phishing ×3T1110 Brute Force ×3T1021 Remote Services ×2T1041 Exfiltration Over C2 Channel ×2
Indicators
filename ×12cve ×7domain ×3ip_v4 ×3hash_sha256 ×2url ×2
Indicator values are available on Pro and via the API.
Associated CVEs
Recent reports
High