Storm-2372

Storm-2372 is a Russia-aligned threat actor that Microsoft assesses with moderate confidence aligns with Russian interests, victimology, and tradecraft. Microsoft reported the group has been active since at least August 2024 and has targeted governments, NGOs, and organizations in sectors including IT services/technology, defense, telecommunications, health, higher education, and energy/oil and gas across Europe, North America, Africa, and the Middle East. The actor is known for device code phishing campaigns that abuse legitimate OAuth device code authentication flows to capture access and refresh tokens after victims authenticate on the legitimate Microsoft device login page. Microsoft observed Storm-2372 using lures that resembled WhatsApp, Signal, and Microsoft Teams experiences, including phishing emails masquerading as Microsoft Teams meeting invitations. The group likely also approached targets through third-party messaging services while impersonating prominent relevant individuals to build rapport. Post-compromise, Storm-2372 used Microsoft Graph for data collection and email harvesting, including searching compromised mailboxes with terms such as "username," "password," "admin," "teamviewer," "anydesk," "credentials," "secret," "ministry," and "gov," and exfiltrating matching emails. Microsoft also observed the actor using compromised accounts to send additional device-code phishing messages internally for lateral movement. In an updated technique observed on February 14, 2025, Storm-2372 shifted to the Microsoft Authentication Broker client ID in the device code flow, enabling receipt of a refresh token that could be used to request a token for device registration. Microsoft reported this allowed the actor to register an attacker-controlled device in Entra ID and then obtain a Primary Refresh Token (PRT) for continued access to organizational resources. The actor also used regionally appropriate proxies to reduce detection. Aliases directly referenced in the content in connection with device code phishing activity include APT29, UTA0304, and UTA0307, though the content does not state these are definitive synonyms for Storm-2372. Additional Russia-aligned clusters mentioned in related reporting include UNK_AcademicFlare.