Storm-0940

Storm-0940 is a Chinese threat actor active since at least 2021, known for gaining initial access through password spray and brute-force attacks, as well as exploiting network edge applications. Microsoft has observed Storm-0940 utilizing valid credentials obtained from CovertNetwork-1658's password spray operations, indicating a close operational relationship between the two. Once inside a… Source: MISP

Attributed country: CN according to MISP

Relationships come from co-occurrence in the news, not attribution. Sources: MISP galaxy and SigmaHQ.