Storm-0473 is a threat actor attributed to KZ, also known as UNC2849. This group is tracked in the Strobes VI threat intelligence database.

What vulnerabilities does Storm-0473 exploit?

Specific CVE exploitation data for Storm-0473 is being tracked. Check the Strobes VI threat actor profile for updates.

Storm-0473

Also known as: UNC2849

Exploited CVEs

Overview

Storm-0473 (Tomiris) is a threat actor that has been active since at least 2019. They primarily target government and diplomatic entities in the Commonwealth of Independent States region, with occasional victims in other regions being foreign representations of CIS countries. Tomiris uses a wide variety of malware implants, including downloaders, backdoors, and file stealers, developed in different programming languages. They employ various attack vectors such as spear-phishing, DNS hijacking, and exploitation of vulnerabilities. There are potential ties between Tomiris and Turla, but they are considered separate threat actors with distinct targeting and tradecraft by Kaspersky.

Exploited Vulnerabilities

No exploited CVEs have been attributed to this threat actor yet.

Browse CVE Database