Watch Floor
RansomwareMITRE G1024

Storm-1567

Also known as Akira, PUNK SPIDER, GOLD SAHARA, Howling Scorpius

2mentions, 7 days
2mentions, 30 days
40victims posted, 30 days
Nov 6, 2026last mentioned

Storm-1567 is the threat actor behind the Ransomware-as-a-Service Akira. They attacked Swedish organizations in March 2023. This ransomware utilizes the ChaCha encryption algorithm, PowerShell, and Windows Management Instrumentation (WMI). Microsoft's Defender for Endpoint successfully blocked a large-scale hacking campaign carried out by Storm-1567, highlighting the effectiveness of their security solution.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

  • Ligne Roset
    Nov 6, 2026
  • Houston Machine and Thread
    Nov 6, 2026
  • System Plus
    Nov 5, 2026
  • David L Wade & Associates
    Nov 5, 2026
  • Source Energy Services
    Nov 5, 2026
  • Westboro Partners
    Nov 5, 2026
  • Erowa
    Nov 4, 2026
  • Krishnan
    Nov 4, 2026
  • SK Global Software
    Nov 3, 2026
  • Pelham Plastics
    Nov 3, 2026
  • Bison Bag
    Nov 3, 2026
  • Howells Motor Freight
    Nov 2, 2026
  • Princeton Management
    Nov 2, 2026
  • Usnext
    Nov 2, 2026
  • FrenchCreek Production
    Oct 30, 2026
  • Service One Transportation
    Oct 30, 2026
  • Hudson & Hudson Sign Products
    Oct 30, 2026
  • Trulife
    Oct 28, 2026
  • Roberts Consulting Services
    Oct 28, 2026
  • Insurance Services
    Oct 28, 2026
  • Bravilor Bonamat
    Oct 23, 2026
  • SCHWAB-SYSTEM
    Oct 23, 2026
  • Bankruptcy Software Specialists
    Oct 23, 2026
  • Bethany Press International
    Oct 22, 2026
  • Medienwerkstatt
    Oct 22, 2026
  • Annapath
    Oct 22, 2026
  • Flextron Circuit Assembly
    Oct 21, 2026
  • Cascade Flooring America
    Oct 21, 2026
  • Svd (Sun Valley Dairy)
    Oct 15, 2026
  • Videk
    Oct 15, 2026

A leak-site post is the group's claim, not confirmed by the victim.

ATT&CK techniques

T1003.001 LSASS MemoryT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1027.001 Binary PaddingT1036.005 Match Legitimate Resource Name or LocationT1047 Windows Management InstrumentationT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.002 AppleScriptT1059.003 Windows Command ShellT1078 Valid AccountsT1078.002 Domain AccountsT1082 System Information DiscoveryT1112 Modify RegistryT1133 External Remote ServicesT1136.001 Local AccountT1136.002 Domain AccountT1190 Exploit Public-Facing ApplicationT1213.002 SharepointT1219 Remote Access ToolsT1229 Assess KITs/KIQs benefitsT1482 Domain Trust DiscoveryT1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1531 Account Access RemovalT1558 Steal or Forge Kerberos TicketsT1560.001 Archive via UtilityT1562.001 Disable or Modify ToolsT1567.002 Exfiltration to Cloud StorageT1570 Lateral Tool TransferT1657 Financial TheftT1685 Disable or Modify Tools

Recent activity

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.