Storm-2755
Storm-2755 is a financially motivated criminal threat actor tracked by Microsoft. The group has conducted "payroll pirate" attacks targeting Canadian users and employees, with observed activity across healthcare, manufacturing, and food services environments. Microsoft also linked broader campaign activity to clusters Storm-2755 and Storm-2657. Storm-2755 uses SEO poisoning and malvertising on generic search terms such as "Office 365" and misspellings such as "Office 265" to lure victims to attacker-controlled infrastructure, including bluegraintours[.]com, which hosts fake Microsoft 365 sign-in pages. The actor uses adversary-in-the-middle phishing to steal credentials, session cookies, and OAuth access tokens, allowing reuse of authenticated Microsoft 365 sessions and bypass of non-phishing-resistant MFA. After account compromise, Storm-2755 searches compromised mailboxes and directory data for payroll-, HR-, finance-, and admin-related personnel and content. Reported activity includes use of Microsoft Graph API queries, including bulk user enumeration, to identify payroll and HR targets. The actor then impersonates employees in emails to HR or finance, including messages with the subject line "Question about direct deposit," to fraudulently change payroll instructions. In some cases, the group directly accessed HR SaaS platforms such as Workday using stolen sessions and modified direct-deposit banking details so salary payments were redirected to attacker-controlled bank accounts. To conceal activity, Storm-2755 has created inbox rules to hide HR responses containing terms such as "bank" or "direct deposit," and maintained persistent access through continued non-interactive sign-ins. Microsoft observed activity associated with the Axios 1.7.9 user-agent and recurring OfficeHome sign-ins. The campaign was described as leaving little or no endpoint footprint, with detection relying primarily on Microsoft Entra sign-in telemetry and Microsoft Graph activity logs. Known aliases and related cluster naming directly mentioned in the content: Storm-2755; related cluster Storm-2657.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Health Care Equipment & Services
- Food, Beverage & Tobacco
- Capital Goods
Where they're from
Attributed origin per open-source reporting.
- US
- CA
Tradecraft
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Observables
19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting account takeover and payroll diversion operations by using adversary-in-the-middle phishing to steal Microsoft 365 session tokens, bypass MFA, enumerate payroll/HR staff via Microsoft Graph API, and redirect employee direct deposits.
Associated with the Payroll Pirate campaign targeting corporate finance, HR, payroll, and administrative personnel to steal employee salary payments through account manipulation.
Conducting payroll diversion attacks against Canadian users by stealing Microsoft 365 credentials and session tokens, then socially engineering HR or finance staff to change direct deposit information to attacker-controlled bank accounts.
Conducting financially motivated 'payroll pirate' attacks that hijack Microsoft 365 sessions via adversary-in-the-middle phishing, then abuse compromised email and HR platform access to redirect employee salary payments to attacker-controlled bank accounts.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.