Storm-0249 Exploits EDRs for Covert Malware Attacks

Scworld

Storm-0249 Exploits EDRs for Covert Malware Attacks

First seen 11 Dec 2025, 02:49 UTC • •30.6

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Initial access broker Storm-0249 is exploiting endpoint detection and response solutions, specifically SentinelOne, to execute stealthy malware attacks. The group has shifted from mass phishing tactics to more advanced methods, utilizing malicious curl commands and PowerShell scripts to gain SYSTEM privileges and establish persistence for ransomware operations.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 200d ago How this analysis works

More articles in this cluster (2)

Threat Graph

14 entities, 22 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (6)

Malware
Phishing
Ransomware
T1059.001 - PowerShell
T1566 - Phishing
T1574.002 - Dll Side-Loading

Organization (1)

SentinelOne

Affected Platform (1)

Windows

Threat Actor (2)

Alphv
Lockbit

Tool (4)

Curl
Findstr.exe
PowerShell
reg.exe

Relationships

Alphv uses Curl
Alphv uses Findstr.exe
Alphv uses PowerShell
Alphv uses reg.exe
Lockbit uses Curl
Lockbit uses Findstr.exe
Lockbit uses PowerShell
Lockbit uses reg.exe
Alphv uses Malware
Alphv uses Phishing
Alphv uses Ransomware
Alphv uses T1059.001 - PowerShell
Alphv uses T1566 - Phishing
Lockbit uses Malware
Lockbit uses Phishing
Lockbit uses Ransomware
Lockbit uses T1059.001 - PowerShell
Lockbit uses T1566 - Phishing
Alphv targets SentinelOne
Lockbit targets SentinelOne
Alphv related to T1574.002 - Dll Side-Loading
Alphv related to Windows

Following this threat?

Track Alphv and SentinelOne in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

FBI Unveils New Cyber Strategy Amid Rising Threats from State-Sponsored Actors On September 9, 2026, the FBI announced its first public cybersecurity strategy aimed at combating malicious cyber activities from state-sponsored actors, particularly focusing on threats from China, Russia, Iran, and North Korea. The strategy outlines four main pillars: disrupting adversaries, supporting victims…

RansomHouse Targets Namibian Defence Ministry in Cyberattack The Namibia Cyber Security Incident Response Team (Nam-CSIRT) confirmed a cyberattack on the Ministry of Defence and Veterans Affairs, linked to the ransomware group RansomHouse. The attack involved unauthorized activity within the ministry's network, with RansomHouse threatening to release stolen information.…