Storm-0324
Aliases: DEV-0324, Sagrid, TA543
- Primary motivation
- financial-gain
- Sophistication
- intermediate
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:04:32
Targeted industries: financial-services retail-and-hospitality technology-and-telecommunications
Context
The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment.
Detection coverage
- 3 YARA rules
Malware & tools used
- JSSLoader (malware)
Reports & references
- Microsoft — Malware Distributor Storm 0324 Facilitates Ransomware Access (report)
- proofpoint.com — Jssloader Recoded And Reloaded (report)