https://blog.dansec.red/actors/storm-1977/Recent content in Storm-1977 on DanSec DailyHugoen-gbSun, 27 Apr 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-04-27-cybersecurity-news/Sun, 27 Apr 2025 00:00:00 +0000https://blog.dansec.red/posts/2025-04-27-cybersecurity-news/<h2 id="major-incidents-or-breaches">Major Incidents or Breaches</h2> <ul> <li>Microsoft has disclosed ongoing attacks by the threat actor Storm-1977, targeting cloud tenants in the education sector. The group has used password spraying techniques to compromise accounts and has deployed over 200 crypto mining containers within affected environments.</li> </ul> <h2 id="notable-threat-actor-activity">Notable Threat Actor Activity</h2> <ul> <li>Storm-1977 continues to focus on education sector cloud environments, utilising automated password spraying and deploying crypto mining infrastructure post-compromise, indicating a trend towards monetisation via illicit resource use.</li> </ul> <h2 id="trends-tools-or-tactics-of-interest">Trends, Tools, or Tactics of Interest</h2> <ul> <li>Password spraying remains an effective attack vector against cloud-based accounts, particularly in sectors with broad user bases and potentially weaker password hygiene.</li> <li>Brave has released &ldquo;Cookiecrumbler,&rdquo; an open-source tool leveraging large language models (LLMs) and community input to identify and block intrusive cookie consent notices, reflecting a trend towards AI-assisted privacy tools and community-driven content moderation.</li> </ul> <h2 id="other-security-developments">Other Security Developments</h2> <ul> <li>Coinbase resolved a bug in its 2FA account activity logs that previously led users to mistakenly believe their accounts had been compromised.</li> </ul>