Storm-2561 uses SEO poisoning to push fake VPN downloads that install signed trojans and steal VPN credentials. Active since ...
The financially motivated group has been active since May 2025, impersonating Fortinet, Ivanti, Cisco, and other vendors to ...