Storm-0381
DEV-0381
Storm-0381 is a threat actor identified by Microsoft as a Russian cybercrime group. They are known for their use of malvertising to deploy Magniber, a type of ransomware.
origin (suspected)
Russia
source: misp-galaxy1 refs →
Storm-0381· Russia
Storm-0381 is a Russian cybercrime group tracked by Microsoft, known for large-scale malvertising campaigns to distribute Magniber ransomware.
Analyst brief
Storm-0381, also tracked as DEV-0381, is a Russian cybercrime group identified by Microsoft. They target a broad set of victims, primarily focusing on individual users through widespread malvertising campaigns. Their main TTP involves using malicious advertisements to distribute fake installers for popular software, ultimately deploying Magniber ransomware. Defenders should focus on filtering suspicious advertisements, cautioning users against unexpected software installation prompts, and implementing strong endpoint protection against ransomware.
unknown
FAQ2
What primary method does Storm-0381 use to infect victims?
Storm-0381 uses malvertising campaigns that target a broad set of victims, primarily individual users, to distribute fake installers of popular software.
Which ransomware does Storm-0381's malvertising campaign ultimately deploy?
The malvertising campaign run by Storm-0381 uses fake software installers to infect victims and ultimately deploy Magniber ransomware.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.