Threat Actor
Storm-2561
- First Reported
- Oct 13, 2026
- Latest Reported
- Oct 21, 2026
Reported Context (2)
- A cited Microsoft report identifies this actor as using SEO poisoning to distribute fake VPN clients for credential theft. Zscaler VPN Risk Report Highlights Patching, Inspection and Containment Gaps
- Microsoft attributed a wider campaign iteration involving watchguard-vpn[.]com to Storm-2561; the article does not establish that this actor controlled the October watchguard-vpn[.]net activity. Fake WatchGuard VPN Site Harvests Credentials, Then Delivers Genuine Signed Client
CVE (1)
People (5)
Threat Actors (6)
MITRE ATT&CK (8)
Vendors (8)
Products (10)
Tools (1)
Industries (6)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.