Deploy autonomous AI agents that reason, exploit, and validate complex vulnerability chains — not another scanner, an agentic system that thinks like a senior pentester.
Storm-2945 is a sub-cluster of Midnight Blizzard conducting targeted traffic manipulation attacks on hospitality sector networks served by captive portals, leveraging doppelganger domains for AitM phishing and malware delivery. Their operations include AI-augmented device code and OAuth code phishing campaigns leading to Entra device registration and data collection from Microsoft 365. The primary malware used is CornFlake, a Windows RAT that features customizable capabilities for data collection and evasion. Storm-2945 also utilizes the FruitStone web-based C2 panel to manage their campaign infrastructure and compromised endpoints.
No exploited CVEs have been attributed to this threat actor yet.
Browse CVE Database