Threat actor · all actors
Storm-1567MISP-3a912680 unknown
aka Akira, PUNK SPIDER, GOLD SAHARA
Last updated: 2026-06-01
8attributed CVEs
0ATT&CK techniques
34.5IDF score (tooling uniqueness)
0exclusive CVEs
2020–2024years active
About this actor
Storm-1567 is the threat actor behind the Ransomware-as-a-Service Akira. They attacked Swedish organizations in March 2023. This ransomware utilizes the ChaCha encryption algorithm, PowerShell, and Windows Management Instrumentation (WMI). Microsoft's Defender for Endpoint successfully blocked a large-scale hacking campaign carried out by Storm-1567, highlighting the effectiveness of their security solution.
Source: MISP threat-actor catalog
Activity timeline
Find actors who…
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
CVE-2020-3580 KEV | 8.8 | 6.1 | 0.9332 | 2020-10-21 | network |
CVE-2023-27532 KEV | 8.6 | 7.5 | 0.8486 | 2023-03-10 | application |
CVE-2024-40711 KEV | 8.3 | 9.8 | 0.7270 | 2024-09-07 | application |
CVE-2024-37085 KEV | 7.9 | 6.8 | 0.7562 | 2024-06-25 | application |
CVE-2020-3259 KEV | 7.7 | 7.5 | 0.6973 | 2020-05-06 | network |
CVE-2023-28252 KEV | 7.3 | 7.8 | 0.6189 | 2023-04-11 | microsoft |
CVE-2024-40766 KEV | 4.2 | 9.8 | 0.0353 | 2024-08-23 | network |
CVE-2023-20269 KEV | 3.1 | 5.0 | 0.0119 | 2023-09-06 | network |
Not tracked in MITRE ATT&CK (this actor has no technique associations in the STIX bundle).
Top mitigating NIST 800-53 controls (by ATT&CK technique coverage)
No mitigating-control coverage computed — actor has no MITRE ATT&CK techniques on file.
Co-occurring actors
- Akira 8 shared CVEs
- Water Galura 1 shared CVE
- BlackByte 1 shared CVE
- Kimsuky 1 shared CVE
Similar actors
Overlapping CVEs
- Akira 0.50
- Water Galura 0.12
- Kimsuky 0.06
- BlackByte 0.05
Active in same years
- APT28 4.00
- Darkhotel 4.00
- APT29 4.00
- Inception 4.00
- Fox Kitten 4.00