Storm-0867
Aliases: DEV-0867
- First seen
- 2012-01-01 00:00:00
- Origin
- EG
- Primary motivation
- financial-gain
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:12:46
Targeted industries: financial-services technology-and-telecommunications healthcare-and-pharmaceutical
Context
Storm-0867 is a threat actor that has been active since 2012 and has targeted various industries and regions. They employ sophisticated phishing campaigns, utilizing social engineering techniques and a phishing as a service platform called Caffeine. Their attacks involve intercepting and manipulating communication between users and legitimate services, allowing them to steal passwords, hijack sign-in sessions, bypass multifactor authentication, and modify authentication methods.
Reports & references
- Microsoft — 3911769 (report)