SYMBOLCOMMON_NAMEaka. SYNONYMS

Storm-1295  (Back to overview)

aka: DEV-1295

Storm-1295 is a threat actor group that operates the Greatness phishing-as-a-service platform. They utilize synchronous relay servers to present targets with a replica of a sign-in page, resembling traditional phishing attacks. Their adversary-in-the-middle capability allows Storm-1295 to offer their services to other attackers. Active since mid-2022, Storm-1295 is tracked by Microsoft and is known for their involvement in the Greatness PhaaS platform.


Associated Families

There are currently no families associated with this actor.


References
2023-08-28Twitter (@MsftSecIntel)Microsoft Threat Intelligence
Tweet on AiTM phishing trends
Storm-1295
2023-06-30MicrosoftHeike Ritter
Monthly news - July 2023
Storm-1295

Credits: MISP Project