Storm-1283

Threat actor0 reports from 0 vendors

Storm-1283 is a threat actor that targeted Microsoft Azure cloud platform. They gained access to user accounts and created OAuth applications using stolen credentials, allowing them to control resources and deploy virtual machines for cryptomining. The targeted organizations incurred significant financial losses ranging from $10,000 to $1.5 million. Storm-1283 utilized compromised accounts and subscriptions to carry out their illicit activities.

Vendor aliases (1)

The same group is tracked under different names by different vendors.

Vendor	Name
Various	Storm-1283

MITRE ATT&CK techniques (0)

No techniques mapped yet.

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names Storm-1283, newest first. Open any report to see the full analysis with provenance.

No reports in the Lore library name this actor yet.

Threat feed IOCs (0)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Storm-1283. Each row shows why it was linked and where it came from.

No feed indicators linked to this actor yet. Feeds are checked every hour.

Public research & publications (1)

Open-source reports about this actor collected from MISP Galaxy.

microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/12/12/threat-actors-misuse-oauth-applications-to-automate-financially-driven-attacks/