Scworld

Storm-0249 Exploits EDRs for Covert Malware Attacks

First seen 11 Dec 2025, 02:49 UTC • Bleepingcomputer

•88% similarity •30.6

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Initial access broker Storm-0249 is exploiting endpoint detection and response solutions, specifically SentinelOne, to execute stealthy malware attacks. The group has shifted from mass phishing tactics to more advanced methods, utilizing malicious curl commands and PowerShell scripts to gain SYSTEM privileges and establish persistence for ransomware operations.

ThreatCluster AI How this analysis works

Attack Flow

14 entities, 22 inferred relationships (STIX 2.1).

Technique (6)

Malware
Phishing
Ransomware
T1059.001 - PowerShell
T1566 - Phishing
T1574.002 - Dll Side-Loading

Organization (1)

SentinelOne

Affected Platform (1)

Windows

Threat Actor (2)

Alphv
Lockbit

Tool (4)

Curl
Findstr.exe
PowerShell
reg.exe

Relationships

Alphv uses Curl
Alphv uses Findstr.exe
Alphv uses PowerShell
Alphv uses reg.exe
Lockbit uses Curl
Lockbit uses Findstr.exe
Lockbit uses PowerShell
Lockbit uses reg.exe
Alphv uses Malware
Alphv uses Phishing
Alphv uses Ransomware
Alphv uses T1059.001 - PowerShell
Alphv uses T1566 - Phishing
Lockbit uses Malware
Lockbit uses Phishing
Lockbit uses Ransomware
Lockbit uses T1059.001 - PowerShell
Lockbit uses T1566 - Phishing
Alphv targets SentinelOne
Lockbit targets SentinelOne
Alphv related to T1574.002 - Dll Side-Loading
Alphv related to Windows

Community

Browse all →

Tracked Entities in This Story

Alphv Lockbit SentinelOne Windows

Storm-0249 Exploits EDRs for Covert Malware Attacks

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story