Skip to content

Storm-2372

Named by 2 kept items in this workspace.

Search every workspace for Storm-2372. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • We Need to Talk About Device Code Phishing
    article2026-06-22

    Suspected Russian nation-state threat actor active since August 2024; targeted governments, NGOs, defense, telecom, healthcare, and energy organizations across Europe, North America, Africa, and the Middle East. In February 2025, used Microsoft Teams meeting invite lures and device code phishing to

  • Inside Kali365, a Device Code Phishing Ecosystem | Huntress
    writeup2026-06-11

    Threat actor previously reported by Microsoft; Kali365 investigation surfaced behavior consistent with Storm-2372 tactics, including use of the Microsoft Authentication Broker client ID to obtain refresh tokens supporting downstream device registration and email access.

All threat actors in this workspace.