Storm-1567 is the threat actor behind the Ransomware-as-a-Service Akira. They attacked Swedish organizations in March 2023. This ransomware utilizes the ChaCha encryption algorithm, PowerShell, and Windows Management Instrumentation (WMI). Microsoft's Defender for Endpoint successfully blocked a large-scale hacking campaign carried out by Storm-1567, highlighting the effectiveness of their security solution.
The same group is tracked under different names by different vendors.
| Vendor | Name |
|---|---|
| OSINT | Akira |
| OSINT | PUNK SPIDER |
| OSINT | GOLD SAHARA |
| OSINT | Howling Scorpius |
No IOCs extracted yet from reports naming this actor.
Every report in the Global Intel Library that names Storm-1567, newest first. Open any report to see the full analysis with provenance.
Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to Storm-1567. Each row shows why it was linked and where it came from.
No feed indicators linked to this actor yet. Feeds are checked every hour.
Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.