Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees
Excerpt
In this article Storm-2755’s attack chain Defending against Storm-2755 and AiTM campaigns Microsoft Defender detection and hunting guidance Indicators of compromise Microsoft Incident Response – Detection and Response Team (DART) researchers observed an emerging, financially motivated threat actor that Microsoft tracks as Storm-2755 conducting payroll pirate attacks targeting Canadian users. In this campaign, Storm-2755 compromised user accounts to gain unauthorized access to…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Attack Flow8 steps · MITRE ATT&CK mapped
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2025-27152 | Medium | Score 51/100 | First seen |
| URL | http://bluegraintours.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…