Storm-0940

A China-based threat actor tracked by Microsoft that conducts credential theft and espionage. It used passwords harvested through the CovertNetwork-1658 botnet of compromised routers to access government, think-tank, law, defense, and other organizations in North America and Europe.