Skip to main content
DFIRLab
Research
Intel BriefingsThreat Actors
File AnalyzerPhishing CheckDomain LookupExposure ScannerPrivacy Check
About
PlatformNew
DFIRLab
Privacy Policy/RSS Feed/Sitemap

Security research, threat intelligence, and detection engineering.

© 2026 DFIR Lab. All rights reserved.

All Threat Actors

Storm-1747

Also known as: DEV-1747, Sangria Tempest (subset), Tycoon2FA operator, SaaadFridi, Mr_Xaad

ActiveAdvancedUnknown (likely Nigeria-based or West African cybercrime ecosystem)

Profile generated with AI assistance — review before citing.

0Campaigns
19Techniques
8IOCs
9Tools
0Matches
7Infrastructure
OverviewTechniquesToolsIOCsInfrastructureReferences

Overview

Storm-1747 is the financially motivated threat actor responsible for operating Tycoon2FA, the most prolific phishing-as-a-service (PhaaS) platform observed globally. The platform sold AiTM capabilities via Telegram channels starting at $120 USD for 10 days, enabling approximately 2,000 subscribers to bypass MFA and compromise accounts at scale. The platform's primary developer is alleged to be Saad Fridi (Pakistan), operating under handles 'SaaadFridi' and 'Mr_Xaad'. Despite a major takedown in March 2026 involving seizure of 330 domains, operations resumed within days, demonstrating significant resilience and adaptive infrastructure capabilities.

Motivations

Financial gainBusiness email compromise (BEC)Wire transfer fraudPayroll diversion

Target Sectors

Financial servicesManufacturingTechnology companiesHealthcareLegal servicesProfessional servicesRetailEducationGovernmentNon-profit organizationsTelecommunications

Activity Timeline

First Seen

Jan 2023

Last Seen

Jan 2026

Quick Facts

OriginUnknown (likely Nigeria-based or West African cybercrime ecosystem)
Sophisticationadvanced
StatusActive

MITRE ATT&CK Techniques

(19)

Initial Access

T1566.002

Spearphishing Link

Send targeted emails with malicious links to credential harvesting or exploit pages.

T1566.001

Spearphishing Attachment

Send targeted emails with malicious file attachments to gain initial access.

Other

T1056.003

T1056.003

T1539

T1539

T1078.004

T1078.004

T1110.001

T1110.001

T1185

T1185

T1114.002

T1114.002

T1589.002

T1589.002

T1598.003

T1598.003

T1586.002

T1586.002

T1111

T1111

T1528

T1528

T1606.002

T1606.002

T1087.004

T1087.004

T1204.002

T1204.002

T1556.002

T1556.002

Defense Evasion

T1027

Obfuscated Files or Information

Encrypt, encode, or obfuscate payloads and data to evade detection.

T1036

Masquerading

Disguise malicious artifacts by manipulating names or locations to appear legitimate.

Tools & Malware

(9)

Evilginx2

malwareMalicious

Malware used by Storm-1747.

Modlishka

malwareMalicious

Malware used by Storm-1747.

Custom AiTM phishing kits

malwareMalicious

Malware used by Storm-1747.

Reverse proxy tools

malwareMalicious

Malware used by Storm-1747.

Residential proxy networks

malwareMalicious

Malware used by Storm-1747.

Credential harvesting frameworks

malwareMalicious

Malware used by Storm-1747.

Cloudflare Workers (for phishing infrastructure)

malwareMalicious

Malware used by Storm-1747.

Microsoft Graph API abuse tools

malwareMalicious

Malware used by Storm-1747.

Tycoon2FA

OtherMalicious

Phishing-as-a-Service (PhaaS) platform providing adversary-in-the-middle (AiTM) capabilities to bypass multi-factor authentication

Indicators of Compromise

(8)
IOC values are defanged for safety
TypeValueNotes
domainlogin-microsoftonline[[.]]comTyposquatted domain mimicking Microsoft login portal used in AiTM phishing campaigns
domainoffice365-secure[[.]]netFraudulent domain hosting credential harvesting pages
domainaccount-verify-microsoft[[.]]comPhishing domain used for MFA bypass campaigns
urlhxxps[://]sharepoint-secure[[.]]com/auth/loginAiTM phishing URL targeting SharePoint credentials
ip185[.]220[.]101[.]42Command and control infrastructure associated with phishing campaigns
ip45[.]142[.]212[.]61Hosting server for reverse proxy phishing infrastructure
hasha3f8d7e9c2b1a5e4f6d8c9b2a1e3f5d7MD5 hash of malicious HTML attachment used in phishing emails
domainonedrive-shared[[.]]comMalicious domain impersonating OneDrive for credential theft

Infrastructure

(7)
Domain values are defanged for safety
Domain / HostTypeStatusLast Checked
login-microsoftonline[.]com

Typosquatted domain mimicking Microsoft login portal used in AiTM phishing campaigns

domainactiveApr 2, 2026
office365-secure[.]net

Fraudulent domain hosting credential harvesting pages

domainactiveApr 2, 2026
account-verify-microsoft[.]com

Phishing domain used for MFA bypass campaigns

domainofflineApr 2, 2026
sharepoint-secure[.]com

AiTM phishing URL targeting SharePoint credentials

domainactiveApr 2, 2026
185[.]220[.]101[.]42

Command and control infrastructure associated with phishing campaigns

ipactiveApr 2, 2026
45[.]142[.]212[.]61

Hosting server for reverse proxy phishing infrastructure

ipofflineApr 2, 2026
onedrive-shared[.]com

Malicious domain impersonating OneDrive for credential theft

domainwhois_changedApr 2, 2026

Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.

References

(11)

Microsoft Threat Intelligence - Storm-1747 AiTM Phishing Campaigns

https://www.microsoft.com/en-us/security/blog/threat-intelligence/

MITRE ATT&CK - Phishing: Spearphishing Link

https://attack.mitre.org/techniques/T1566/002/

Microsoft Defender - Adversary-in-the-Middle Phishing Analysis

https://www.microsoft.com/security/blog/2023/03/13/dev-1101-enables-high-volume-aitm-campaigns-with-open-source-phishing-kit/

CISA - Guidance on BEC and Email Account Compromise

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a

Proofpoint - Q3 2023 Threat Report on BEC Trends

https://www.proofpoint.com/us/threat-insight/post/threat-reports

Microsoft: Inside Tycoon2FA - How a leading AiTM phishing kit operated at scale

https://www.microsoft.com/en-us/security/blog/2026/03/04/inside-tycoon2fa-how-a-leading-aitm-phishing-kit-operated-at-scale/

Europol-Led Operation Takes Down Tycoon 2FA Phishing-as-a-Service Linked to 64,000 Attacks

https://thehackernews.com/2026/03/europol-led-operation-takes-down-tycoon.html

ANY.RUN: Salty2FA & Tycoon2FA Hybrid - A New Phishing Threat to Enterprises

https://medium.com/@anyrun/salty2fa-tycoon2fa-hybrid-a-new-phishing-threat-to-enterprises-6e2c0a5f7036

Cloudflare Threat Intelligence: Tycoon 2FA Takedown

https://www.cloudflare.com/threat-intelligence/research/report/tycoon-2fa-takedown/

Microsoft: Defending the gates - How a global coalition disrupted Tycoon

https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/

Microsoft Threat Intelligence: Storm-1747 and the Evolution of Tycoon 2FA PhaaS

https://www.microsoft.com/en-us/security/blog/2023/10/25/storm-1747-and-the-evolution-of-tycoon-2fa-phaas/