File · Storm-1567 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 17 techniques across 11 tactics
Last 30 days
last seen 14 d ago- seen against
- United States · Mexico · Brazil · Italy
- sectors
- Manufacturing · Professional Services · Not Found · Other · Agriculture and Food Production
What changed
ledger · newest first- —17 d agovictimsvictim count 75 → 85 (+10)
- —24 d agovictimsvictim count 65 → 75 (+10)
- —1 mo agovictimsvictim count 58 → 65 (+7)
Analyst brief
misp-galaxy + mitre-attackStorm-1567 is the threat actor behind the Ransomware-as-a-Service Akira. They attacked Swedish organizations in March 2023. This ransomware utilizes the ChaCha encryption algorithm, PowerShell, and Windows Management Instrumentation (WMI). Microsoft's Defender for Endpoint successfully blocked a large-scale hacking campaign carried out by Storm-1567, highlighting the effectiveness of their security solution.
Observed targets (as stated by the sources)
8 countries · 12 sectorsassessed originnot stated by sourcesobserved targets · 8
countries · 8
- United States
- Germany
- Brazil
- Mexico
- United Kingdom
- Switzerland
- Italy
- Canada
sectors · 12
- Manufacturing
- Professional Services
- Not Found
- Other
- Retail & E-Commerce
- Technology
- Agriculture and Food Production
- Transportation
- Energy & Utilities
- Financial Services
- Hospitality
- Healthcare
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique17 techniques · 11 of 15 tactics
Execution
1 techniquePersistence
1 techniqueStealth
3 techniquesDefense impairment
1 techniqueCredential access
1 techniqueDiscovery
2 techniquesLateral movement
1 techniqueCollection
2 techniquesCommand and control
1 techniqueExfiltration
1 techniqueImpact
3 techniques
select a technique
Arsenal
3 malware · 5 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Take it with you
keyless · no signupReferences
12 sources- 1.news.sophos.com/en-us/2023/12/20/cryptoguard-an-asymmetric-approach-to…
- 2.securelist.com/crimeware-report-fakesg-akira-amos/111483
- 3.trellix.com/en-us/about/newsroom/stories/research/akira-ransomware…
- 4.blog.sekoia.io/sekoia-io-mid-2023-ransomware-threat-landscape
- 5.decoded.avast.io/threatresearch/avast-q2-2023-threat-report
- 6.attack.mitre.org/groups/G1024
- 7.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-a…
- 8.crowdstrike.com/adversaries/punk-spider
- 9.blog.talosintelligence.com/akira-ransomware-continues-to-evolve
- 10.secureworks.com/research/threat-profiles/gold-sahara
- +2 more in the JSON record
Track Storm-1567 on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.