SYMBOLCOMMON_NAMEaka. SYNONYMS

Storm Cloud  (Back to overview)


Storm Cloud is a Chinese espionage threat actor known for targeting organizations across Asia, particularly Tibetan organizations and individuals. They use a variety of malware families, including GIMMICK and GOSLU, which are feature-rich and multi-platform. Storm Cloud leverages public cloud hosting services like Google Drive for command-and-control channels, making it difficult to detect their activities.


Associated Families

There are currently no families associated with this actor.


References
2020-03-31VolexityVolexity Threat Research
Storm Cloud Unleashed: Tibetan Focus of Highly Targeted Fake Flash Campaign
SpyNote Stitch Godlike12 Storm Cloud

Credits: MISP Project