Storm-1113 (993e81e8-63f4-4666-9538-4053a69287ba)
Storm-1113 is a threat actor that acts both as an access broker focused on malware distribution through search advertisements and as an “as-a-service” entity providing malicious installers and landing page frameworks. In Storm-1113 malware distribution campaigns, users are directed to landing pages mimicking well-known software that host installers, often MSI files, that lead to the installation of malicious payloads. Storm-1113 is also the developer of EugenLoader, a commodity malware first observed around November 2022.
| Cluster A | Galaxy A | Cluster B | Galaxy B | Level |
|---|---|---|---|---|
| Storm-1113 (669b24db-d543-560a-851a-5ba81a586350) | Microsoft Activity Group actor | Storm-1113 (993e81e8-63f4-4666-9538-4053a69287ba) | Threat Actor | 1 |