[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_DK80lxVTF75iXcBTCRWANcwvNouCypsz1OybhYhN20":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":10,"country":11,"suspected_sponsor":11,"target_industries":12,"target_countries":13,"incident_types":14,"references":15,"techniques":18,"technique_count":19,"created_at":20,"seoMetadata":21,"schemaOrg":25},"Storm-0249","storm-0249",[9],"DEV-0249","Storm-0249 is an access broker active since 2021, known for distributing BazaLoader, IcedID, Bumblebee, and Emotet malware. The actor primarily employs phishing emails to deliver malware payloads, as evidenced by a campaign involving tax-themed emails that aimed to distribute BRc4 and Latrodectus malware. Storm-0249 has facilitated initial access for other threat actors, such as Storm-0501, by leveraging compromised credentials and exploiting known vulnerabilities in public-facing servers. Microsoft has detected malicious PDF attachments associated with Storm-0249's phishing campaigns.",null,[],[],[],[16,17],"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2025\u002F04\u002F03\u002Fthreat-actors-leverage-tax-season-to-deploy-tax-themed-phishing-campaigns\u002F","https:\u002F\u002Ftechcommunity.microsoft.com\u002Ft5\u002Fmicrosoft-defender-xdr-blog\u002Fmonthly-news-november-2023\u002Fba-p\u002F3970796",[],0,"2025-04-19T01:15:05.852388+00:00",{"title":22,"metaDescription":23,"keywords":24},"Storm-0249 Threat Actor Profile | EdgeProtect","Storm-0249 is an access broker active since 2021, known for distributing BazaLoader, IcedID, Bumblebee, and Emotet malware. The actor primarily employ...","Storm-0249, DEV-0249, threat actor, APT, cyber threat, threat intelligence",{"@context":26,"@type":27,"name":6,"alternateName":28,"description":10,"url":29,"mainEntityOfPage":30},"https:\u002F\u002Fschema.org","Organization",[9],"https:\u002F\u002Fdev.precursorintelligence.com\u002Fthreat-actors\u002Fstorm-0249",{"@type":31,"@id":29},"WebPage"]