Storm-2561 Uses Fake Enterprise VPN Clients to Steal Credentials
Summary
Microsoft says Storm-2561 uses SEO-poisoned searches and spoofed VPN sites to deliver a fake installer that steals credentials and VPN configuration data. The malware also establishes persistence and redirects victims to legitimate vendor sites.
Key points
- Storm-2561 uses poisoned search results to direct people seeking enterprise VPN clients to spoofed vendor sites.
- The campaign impersonated VPN products from vendors including Ivanti, Cisco, Fortinet, Sophos, and WatchGuard.
- A fake MSI installer drops a loader and the Hyrax infostealer, which captures entered credentials and VPN configuration data.
- The malware uses a now-revoked Taiyuan Lihua certificate and creates persistence through the Windows RunOnce registry key.
- After stealing data, the fake client displays an installation error and redirects users to a legitimate vendor site.
- Microsoft recommends cloud-delivered Defender protection, EDR in block mode, MFA, and SmartScreen-enabled browsers; it also provided IoCs and hunting guidance.
Article Details
- Event Type
- SEO-poisoning campaign distributing spoofed enterprise VPN installers
- Impact
- The fake installers deploy the Hyrax infostealer, which captures entered credentials and VPN configuration data from connectionsstore.dat and sends the data to attacker infrastructure. The malware also creates RunOnce persistence for Pulse.exe. Microsoft reported that the fake client then displays an installation error and redirects users to the legitimate vendor site.
MITRE ATT&CK
Threat Actors
Malware
Products
DefenderMicrosoft advises enabling cloud-delivered Defender protection, running EDR in block mode, enforcing MFA, using SmartScreen-enabled browsers, and applying provided IoCs and hunting guidance.Pulse Secureattackers manipulate search results (SEO poisoning) for common queries like “Pulse VPN download” or “Pulse Secure client” to redirect victims to spoofed VPN vendor sites that closely mimic VPN solutions from