Storm-2990
Storm-2990 is a China-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 6 sectors, including Government and Technology, in 3 countries, including the United States and China. It uses 6 MITRE ATT&CK techniques.
- Origin
- China
- Techniques
- 6
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
6 techniques across 3 of 14 tacticsReconnaissance·
Resource Development·
Initial Access4
T1078.004
Valid Accounts: Cloud Accounts
Valid Accounts: Cloud Accounts
T1566.001
Phishing: Spearphishing Attachment
Phishing: Spearphishing Attachment
T1566.002
Phishing: Spearphishing Link
Phishing: Spearphishing Link
T1566.003
Phishing: Spearphishing via Service
Phishing: Spearphishing via Service
Execution·
Persistence·
Privilege Escalation·
Defense Evasion·
Credential Access1
T1528
Steal Application Access Token
Steal Application Access Token
Discovery·
Lateral Movement·
Collection1
T1114
Email Collection
Email Collection
Command and Control·
Exfiltration·
Impact·
Arsenal · Malware And Tools.
- CoGUImalware
- Haozimalware
- Iron Manmalware
About Storm-2990.
A Chinese-language cybercrime developer cluster specializing in Phishing-as-a-Service (PaaS) frameworks and adversary-in-the-middle phishing kits.
Last updated Oct 15, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.