Storm-0249 Abusing EDR Process Via Sideloading to Hide Malicious Activity

Storm-0249, once known primarily as a mass phishing group, has undergone a significant transformation into a sophisticated initial access broker specializing in precision attacks.

This evolution marks a critical shift in threat tactics, moving away from noisy phishing campaigns toward stealthy, post-exploitation techniques designed to deliver ransomware-ready access to criminal affiliates.

The threat actor now leverages legitimate signed files, particularly those associated with endpoint detection and response (EDR) tools like SentinelOne, to establish persistent footholds within targeted networks.

The group’s operational shift reflects a growing trend among initial access brokers who are adopting advanced evasion methods to increase their success rates.

By selling pre-staged network access to ransomware-as-a-service operators, Storm-0249 accelerates attack timelines and lowers the technical barriers for threat actors downstream.

This business model proves particularly effective because it allows the group to remain hidden within victim environments for extended periods, conducting reconnaissance and preparing infrastructure for eventual ransomware deployment.

ReliaQuest analysts identified that Storm-0249 employs a multi-stage attack chain beginning with social engineering through a technique called ClickFix, which manipulates users into executing malicious commands through the Windows Run dialog.

Once initial access is obtained, the threat actor deploys malicious MSI packages with system-level privileges, creating conditions for subsequent exploitation phases.

The most concerning aspect of Storm-0249’s operations lies in its abuse of trusted EDR processes through dynamic link library sideloading.

Exploitations

The attack exploits a fundamental trust relationship within security software by manipulating legitimate, digitally signed executables like SentinelAgentWorker.exe to load malicious code instead of legitimate libraries.

This technique proves highly effective because security monitoring tools often exclude trusted EDR processes from aggressive scrutiny, creating significant blind spots for defenders.

When SentinelOne’s binary launches, it automatically loads the malicious DLL placed strategically in the AppData folder alongside the legitimate executable.

The compromised process then executes the attacker’s code while appearing as a routine security software operation to detection systems.

This sideloading technique enables Storm-0249 to establish command-and-control communication, conduct reconnaissance activities like extracting machine identifiers needed for encryption binding, and maintain persistence that survives standard remediation attempts.

The technique presents a fundamental challenge: traditional process-based detections built around monitoring command-line tools fail to catch this activity since all malicious execution occurs under a digitally signed, whitelisted security process.

Organizations must implement behavioral analytics and monitor for anomalies such as legitimate executables loading unsigned files from unexpected locations to effectively counter these advanced tactics.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.