Tactics, Techniques & Procedures (TTPs): Utilizes hijacked Wi-Fi networks to deliver malware, specifically targeting users through fake updates.
Actor Profile & Objectives: Storm-2945 is a threat actor group known for exploiting unsecured Wi-Fi networks to distribute malware. Their primary objective appears to be surveillance and data exfiltration, focusing on users in environments with high foot traffic, such as hotels and airports.
Recent Campaign Tactics: Recent reports indicate that Storm-2945 has employed tactics such as delivering fake browser updates to unsuspecting users over compromised Wi-Fi networks, effectively deploying a remote access trojan (RAT) known as CornFlake. This malware captures sensitive information, including webcam images and keystrokes.