Storm-3069

☆ pin

Also known as DAEMON Tools supply chain attackers

Reports

First seen

Sep 28, 2026

Last seen

Oct 5, 2026

Motivation

Espionage

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Other ×2

Top ATT&CK techniques

T1027 Obfuscated Files or Information ×2T1071.001 Application Layer Protocol: Web Protocols ×2T1574.002 Hijack Execution Flow: DLL Side-Loading ×2T1129 Shared Modules ×1T1486 Data Encrypted for Impact ×1T1021.002 Remote Services: SMB/Windows Admin Shares ×1T1566 Phishing ×1T1112 Modify Registry ×1T1570 Lateral Tool Transfer ×1T1105 Ingress Tool Transfer ×1T1140 Deobfuscate/Decode Files or Information ×1T1053 Scheduled Task/Job ×1

Indicators

cve ×139filename ×25hash_sha256 ×6domain ×5

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-102331 CVE-2026-104286 (exploited)CVE-2026-81578 (exploited)CVE-2026-82078 (exploited)CVE-2026-88779 (exploited)CVE-2026-93485 CVE-2026-95389 CVE-2026-95391 CVE-2026-96419 CVE-2026-96421

Recent reports

High