Storm-0324 is a financially motivated group that sells initial network access for ransomware deployment.
Storm-0324 (also tracked as DEV-0324, Sagrid, TA543) is a financially motivated cybercriminal group. They primarily target organizations to gain initial access, which they then hand off to other threat actors, frequently leading to ransomware deployment. Their main TTPs involve email-based initial infection vectors, notably phishing campaigns; tools may include downloaders and lateral movement utilities for facilitating handoffs. Defenders should focus on securing email gateways, scrutinizing suspicious attachments and links, and implementing strong network segmentation and anomaly detection to identify and block initial access attempts before handoff can occur.
The threat actor that Microsoft tracks as Storm-0324 is a financially motivated group known to gain initial access using email-based initial infection vectors and then hand off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment.
Storm-0324 is a financially motivated cybercriminal group. Their main objective is to gain initial access to organizations through email-based phishing campaigns.
After gaining initial access, Storm-0324 hands off access to compromised networks to other threat actors. These handoffs frequently lead to ransomware deployment.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.