Threat Actor
Storm-2754
- First Reported
- Apr 7, 2026
- Latest Reported
- Apr 9, 2026
Reported Context (4)
- The article identifies Storm-2754 as a tracking name associated in part with Forest Blizzard. Forest Blizzard Used Compromised SOHO Routers for DNS Hijacking and AiTM Attacks
- Microsoft identifies Storm-2754 as a sub-group of Forest Blizzard and tracks it as the component associated with this activity. Forest Blizzard Used Compromised SOHO Routers for DNS Hijacking and TLS AiTM Attacks
- Microsoft tracked this as a subgroup of APT28 and attributed the campaign activity to APT28 and Storm-2754. APT28 Used SOHO Router DNS Hijacking in Global FrostArmada Campaign
- The article identifies Storm-2754 as another name used for APT28, which it links to the FrostArmada DNS-hijacking campaign. Authorities Disrupt APT28-Linked FrostArmada Router DNS Hijacking Campaign
CVE (1)
Threat Actors (4)
MITRE ATT&CK (3)
Vendors (6)
Products (10)
Tools (1)
Industries (7)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.