Russian Intelligence-Linked Hackers Storm-2372 Target Instant Messaging Services

This campaign also involved social engineering tactics, as the attackers impersonated real individuals—colleagues or potential clients of their victims. They took the time to establish a trusted relationship before inviting the target to a video call via a link leading to a fake login page for such a service.

This fake page allowed Storm-2372 to steal login credentials and passwords before requesting a two-factor authentication code. This enabled the hackers to access and take control of the victim’s account, granting them entry to numerous sensitive services.

The phishing campaign, which began in August 2024, primarily targeted European governments and Western companies in the tech, defense, energy, and healthcare sectors.