{
  "Event": {
    "analysis": "1",
    "date": "2026-04-09",
    "extends_uuid": "",
    "info": "[Threat Intel] Payroll pirate attacks targeting Canadian employees",
    "protected": false,
    "publish_timestamp": "1776175453",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1776175452",
    "uuid": "bb4a7a22-6701-41cd-b516-6ee789ad5ea7",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#96f4f6",
        "local": false,
        "name": "misp-galaxy:producer=\"Microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#36a9d8",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Discovery - T1087\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b95cd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Phishing - T1566\"",
        "relationship_type": ""
      },
      {
        "colour": "#ed66f6",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Steal Web Session Cookie - T1539\"",
        "relationship_type": ""
      },
      {
        "colour": "#cad64d",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Groups - T1069.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#aff0ae",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Permission Groups Discovery - T1069\"",
        "relationship_type": ""
      },
      {
        "colour": "#62e1b7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Browser Session Hijacking - T1185\"",
        "relationship_type": ""
      },
      {
        "colour": "#c202a1",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Spearphishing Link - T1566.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#77a4ec",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Collection - T1114\"",
        "relationship_type": ""
      },
      {
        "colour": "#12d28f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Account - T1087.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#71ecdb",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Account Manipulation - T1098\"",
        "relationship_type": ""
      },
      {
        "colour": "#70b0b5",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Brute Force - T1110\"",
        "relationship_type": ""
      },
      {
        "colour": "#83203e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Account - T1136.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#a42e64",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data from Information Repositories - T1213\"",
        "relationship_type": ""
      },
      {
        "colour": "#59699c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#f055aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Create Account - T1136\"",
        "relationship_type": ""
      },
      {
        "colour": "#abbbbf",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Modify Authentication Process - T1556\"",
        "relationship_type": ""
      },
      {
        "colour": "#e556be",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Email Forwarding Rule - T1114.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#1faf16",
        "local": false,
        "name": "misp-galaxy:target-information=\"Canada\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#31373d",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"not-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775818807",
        "to_ids": false,
        "type": "link",
        "uuid": "1c57e5ac-e7b8-4d90-af9a-211b7b91e713",
        "value": "https://www.microsoft.com/en-us/security/blog/2026/04/09/investigating-storm-2755-payroll-pirate-attacks-targeting-canadian-employees/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775818807",
        "to_ids": false,
        "type": "text",
        "uuid": "8076fc3f-1a5f-49b2-ab59-2c5759ca82c9",
        "value": "Microsoft Incident Response researchers identified Storm-2755, a financially motivated threat actor conducting payroll pirate attacks against Canadian users. The campaign uses malvertising and SEO poisoning on generic search terms like \"Office 365\" to lure victims to a fraudulent sign-in page. Through adversary-in-the-middle techniques, the actor captures authentication tokens and session cookies, bypassing MFA protections. Storm-2755 maintains persistence using Axios HTTP client to replay stolen tokens, then conducts discovery for payroll and HR contacts. The actor impersonates compromised users to socially engineer HR staff or directly manipulates payroll systems like Workday. Malicious inbox rules hide correspondence from victims. Attacks resulted in direct financial losses through redirected salary payments to attacker-controlled bank accounts."
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775818807",
        "to_ids": false,
        "type": "text",
        "uuid": "a0549850-bfc7-4f34-aa41-9518b4bf4c0f",
        "value": "Name: Payroll pirate attacks targeting Canadian employees\nAuthor: AlienVault\nAdversary: Storm-2755\nTags: [\"malvertising\", \"credential phishing\", \"cve-2025-27152\", \"payroll fraud\", \"session hijacking\", \"aitm\", \"seo poisoning\", \"token theft\", \"canadian targeting\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1078.004\", \"T1087\", \"T1566\", \"T1539\", \"T1069.003\", \"T1069\", \"T1185\", \"T1566.002\", \"T1114\", \"T1087.004\", \"T1098\", \"T1110\", \"T1136.003\", \"T1213\", \"T1078\", \"T1136\", \"T1556\", \"T1114.003\"]\nIndustries: []"
      },
      {
        "category": "Attribution",
        "comment": "Adversary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775818807",
        "to_ids": false,
        "type": "threat-actor",
        "uuid": "74f3a476-840b-449c-a1eb-989ad0acc4a6",
        "value": "Storm-2755"
      },
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1775818807",
        "to_ids": false,
        "type": "vulnerability",
        "uuid": "a8536326-a157-4335-9810-9d86d2981c4e",
        "value": "CVE-2025-27152"
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776167314",
        "to_ids": true,
        "type": "url",
        "uuid": "62852c60-2da7-4dbb-adb8-f2058c24b662",
        "value": "http://bluegraintours.com",
        "Tag": [
          {
            "colour": "#f08989",
            "local": false,
            "name": "NotFoundError",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1776167335",
        "to_ids": true,
        "type": "domain",
        "uuid": "282c285a-d816-4a58-a9e9-1c50f37a92a4",
        "value": "bluegraintours.com",
        "Tag": [
          {
            "colour": "#342294",
            "local": false,
            "name": "CommentAdded",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}