Skip to content
brandefense.io
Request A Demo
UnclassifiedUnknown

Storm-0940

Storm-0940 is a threat actor group, tracked by Brandefense.

Also known as
  • CovertNetwork-1658
  • ORB07
Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
Record updated

About Storm-0940.

Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a victim environment, Storm-0940 has been seen leveraging compromised credentials for further malicious activities. Additionally, Storm-0940 has employed botnets, such as Quad7, to facilitate password spraying attacks.

Last updated Sep 12, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.