CampaignPublished 10 Dec 2025Updated 9 Jan 2026

Threat Spotlight: Storm-0249 Moves from Mass Phishing to Precision EDR Exploitation

Source AlienVault OTX General

Description

Storm-0249, a seasoned initial access broker, has evolved from mass phishing to sophisticated post-exploitation tactics. The group now abuses legitimate Endpoint Detection and Response processes, particularly SentinelOne's SentinelAgentWorker.exe, through DLL sideloading. This allows them to conceal malicious activity as routine operations, bypass defenses, and maintain persistence. Their new tactics include Microsoft domain spoofing, curl-to-PowerShell piping, and fileless execution. Storm-0249's ability to weaponize trusted processes and conduct stealthy reconnaissance poses significant challenges for security teams. The group's evolution represents a broader trend in the ransomware-as-a-service ecosystem, lowering the technical barrier for attackers and accelerating the spread of ransomware across sectors.

Impact

For European organizations, the exploitation of SentinelOne's EDR processes by Storm-0249 could lead to significant operational disruption, data breaches, and ransomware infections. The ability to hide malicious activity within trusted security tools undermines confidence in endpoint defenses and complicates incident detection and response. Critical infrastructure, financial institutions, healthcare providers, and large enterprises that rely on SentinelOne for endpoint protection are particularly vulnerable. Successful exploitation could result in unauthorized access to sensitive data, prolonged persistence within networks, and deployment of ransomware payloads causing downtime and financial losses. The use of domain spoofing and fileless execution increases the risk of successful phishing and lateral movement campaigns, potentially affecting supply chains and cross-border operations. Given the group's role as an initial access broker, compromised organizations may also serve as entry points for further attacks by ransomware affiliates, amplifying the threat's impact across sectors and countries in Europe.

Defensive guidance

European organizations should implement targeted mitigations beyond standard security hygiene. These include: 1) Monitoring and restricting DLL loading paths for SentinelOne's SentinelAgentWorker.exe to prevent unauthorized DLL sideloading; 2) Employing application control policies to whitelist legitimate DLLs and executables associated with EDR tools; 3) Enhancing network monitoring to detect anomalous PowerShell and curl command usage, especially those involving piping and fileless execution patterns; 4) Implementing advanced email security solutions with domain spoofing detection and DMARC enforcement to reduce phishing risks; 5) Conducting regular threat hunting focused on EDR process anomalies and unusual domain resolutions linked to known indicators; 6) Ensuring SentinelOne and other endpoint solutions are updated with the latest threat intelligence and behavioral detection capabilities; 7) Training security teams to recognize signs of EDR exploitation and fileless attacks; 8) Segmenting networks to limit lateral movement opportunities post-compromise; 9) Collaborating with threat intelligence sharing communities to stay informed on evolving TTPs of Storm-0249; 10) Reviewing and tightening PowerShell logging and execution policies to detect and block suspicious command execution chains.

Indicators of compromise

Domains 3

hristomasitomasdf.com
krivomadogolyhp.com
sgcipl.com

IP addresses 1

178.16.52.145

Hashes 6

aa157129a9df47ede836516dd4c7ec2d
d2237059bb738015b0878f99029be3a6
07c5599b9bb00feb70c2d5e43b4b76f228866930
423f2fcf7ed347ee57c1a3cffa14099ec16ad09c
10910179af37ba38786f5a1b59d4dd1c43b6aa512850bbd47fb0feb965b2eb5c
8113fc3b4f82fb49f8dd853ca8e1275e0dfb06e48f39830708e4437fe8afbdfb

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Dec 2025, 09:37 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details

Indicators of compromise

Domains 3

IP addresses 1

Hashes 6

Community reviews

Related threats