Storm-1607
Storm-1607 is a Microsoft-tracked, financially motivated threat cluster associated with large-scale phishing campaigns and use of the ClickFix social engineering technique. Microsoft first observed Storm-1607 using ClickFix between March and June 2024 in email campaigns that used HTML attachments to attempt installation of the DarkGate loader. One observed campaign in May 2024 sent tens of thousands of payment- and invoice-themed phishing emails targeting organizations in the United States and Canada. Microsoft also lists Storm-1607 among threat clusters that have conducted large-scale phishing and malvertising campaigns utilizing ClickFix methodology. In addition, Microsoft observed Storm-1607 using Lumma Stealer in campaigns, alongside other ransomware-associated actors such as Octo Tempest, Storm-1113, and Storm-1674. Based on the provided content, Storm-1607 is linked to phishing, malvertising, HTML attachment delivery, ClickFix lures that induce users to execute malicious commands, and payload delivery including DarkGate and Lumma Stealer.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
- 🇨🇦 Canada
Tradecraft
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Microsoft-tracked activity cluster described as a ransomware group that has used LummaStealer in campaigns.
Microsoft-tracked threat cluster conducting large-scale phishing/malvertising campaigns using the ClickFix methodology (fake verification/CAPTCHA leading to user-executed commands and multi-stage payload delivery).
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.