Storm-0835 is a cybercriminal group known for targeting executives with the EvilProxy phishing toolkit.
Analyst brief
Storm-0835 is a cybercriminal group using the EvilProxy phishing toolkit to target senior executives primarily in U.S. banking, financial services, insurance, property management, real estate, and manufacturing sectors. Active since July 2023, the group exploits an open redirection vulnerability on indeed.com to redirect victims to malicious phishing pages impersonating Microsoft. Key TTPs include credential harvesting, interception of 2FA codes and session cookies for account takeover via EvilProxy's reverse proxy functionality. Defenders should be vigilant against unexpected emails leveraging job search platforms, strengthen multi-factor authentication monitoring, and track anomalous session activities.
Storm-0835
unknown
Cybercriminals have launched a phishing campaign targeting senior executives in U.S. firms, using the EvilProxy phishing toolkit for credential harvesting and account takeover attacks. This campaign, initiated in July 2023, primarily targets sectors such as banking, financial services, insurance, property management, real estate, and manufacturing. The attackers exploit an open redirection vulnerability on the job search platform "indeed.com," redirecting victims to malicious phishing pages impersonating Microsoft. EvilProxy functions as a reverse proxy, intercepting credentials, two-factor authentication codes, and session cookies to hijack accounts. The threat actors, known as Storm-0835 by Microsoft, have hundreds of customers who pay monthly fees for their services, making attribution difficult. The attacks involve sending phishing emails with deceptive links to Indeed, redirecting victims to EvilProxy pages for credential harvesting.