Storm Cloud
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:10:02
Targeted industries: education-and-nonprofits government-and-public-sector
Targeted regions: country_code:cn country_code:in country_code:np
Context
Storm Cloud is a Chinese espionage threat actor known for targeting organizations across Asia, particularly Tibetan organizations and individuals. They use a variety of malware families, including GIMMICK and GOSLU, which are feature-rich and multi-platform. Storm Cloud leverages public cloud hosting services like Google Drive for command-and-control channels, making it difficult to detect their activities.
Reports & references
- volexity.com — Storm Cloud Unleashed Tibetan Community Focus Of Highly Targeted Fake Flash Campaign (report)
- rewterz.com — Rewterz Threat Alert Gimmick Malware Active Iocs (report)