This content requires premium access. Subscribe for full threat intelligence reports and analysis.
Premium
Premium content
Storm-0940: State-Sponsored Brute-Force Attacks Targeting Microsoft 365
Premium access required
storm-0940
PremiumStorm-0940: State-Sponsored Brute-Force Attacks Targeting Microsoft 365
For seven months, a partner organization has faced a persistent brute-force campaign attributed to Storm-0940, a suspected Chinese state-sponsored actor. No accounts have been compromised, but the Microsoft 365 campaign signals growing interest in organizations across the Baltics and Europe.
storm-0940chinabrute-forcemicrosoft-365state-sponsoredthreat-intelligenceapt
MU
By Marvin Uku
01/09/2025
Related reports
This content requires premium access. Subscribe for full threat intelligence reports and analysis.
Premium
Premium content
SILENTLOOM: A Reused Device Pool Behind a Quiet Microsoft 365 Password AttackPremium access required
Free
nation-staterdpcloudzy+7
OVERCAST: Tracking 1,900 Nation-State RDP Nodes Across Cloudzy's C2P Ecosystem
We received 50 validated IPs linked to a suspected Russian state-sponsored APT, profiled them through ClusterHawk, and extracted a common fingerprint. Pivoting that profile against internet scanning data surfaced about 1,900 matching assets across 15 countries. We call this tracking effort OVERCAST.
MU
Marvin Uku
22/02/2026
Free
sidewinderaptclickonce+6
SideWinder's Click Once campaign - independent validation with ClusterHawk
We confirm Trellix's reporting on SideWinder's PDF ClickOnce chain and targets. Testing the method, we pivoted on VirusTotal-communicated IPs and separated CDN/search noise (about 85%) from a compact nginx micro-cluster (about 15%), then built ready-to-run SIEM/Sigma and Shodan/Censys hunts.
MU
Marvin Uku
02/11/2025
Comments (0)
You need a premium subscription to view and participate in comments on threat intelligence posts.
