Storm-3121
Also known as Falcon, CL-CRI-1182
Reports
3
First seen
Sep 9, 2026
Last seen
Sep 13, 2026
Motivation
Financial
Targeting
Sectors
Victim regions
United States ×1
Top ATT&CK techniques
T1087 Account Discovery ×2T1078.004 Valid Accounts: Cloud Accounts ×2T1114 Email Collection ×2T1598.003 Phishing for Information: Spearphishing Link ×2T1056.004 Phishing: Adversary-in-the-Middle ×1T1098 Account Manipulation ×1T1591 Gather Victim Org Information ×1T1555 Credentials from Password Stores ×1T1087.004 Account Discovery: Cloud Account ×1T1069.003 Permission Groups Discovery: Cloud Groups ×1T1078 Valid Accounts ×1T1580 Cloud Infrastructure Discovery ×1
Indicators
domain ×37filename ×2
Indicator values are available on Pro and via the API.