Tactics, Techniques & Procedures (TTPs): Utilizes hijacked networks to deliver malware, particularly through fake updates.
Actor Profile & Objectives: Storm-2945 is recognized for its sophisticated tactics in exploiting network vulnerabilities, particularly through hijacked Wi-Fi connections. This group primarily aims to deploy surveillance malware and steal sensitive information from unsuspecting users. Their operations often target environments where users are likely to connect to unsecured networks, such as hotels and public spaces.
Recent Campaign Tactics: Recent reports indicate that Storm-2945 has been active in distributing a remote access trojan (RAT) named CornFlake via fake browser updates served over compromised hotel Wi-Fi networks. This method allows them to capture sensitive data, including webcam images, microphone audio, and keystrokes, effectively compromising user privacy and security.