Storm-0249 Abuses EDR Processes in Stealthy Attacks

Storm-0249, an initial access broker, has pivoted from noisy phishing to precision, loader-centric campaigns that weaponize legitimate EDR processes and built-in Windows utilities. Using a ClickFix social-engineering lure to execute spoofed MSIs, the actor sideloads trojanized DLLs alongside legitimate EDR binaries to achieve SYSTEM-level execution and persistence, and leverages LOLBins (e.g., curl.exe) to pipe fileless PowerShell into memory for stealthy post-compromise activity. ReliaQuest recommends behavioral analytics, EDR baselining, DNS monitoring, strict LOLBin restrictions, network segmentation, and automated response playbooks to mitigate these tactics.