---
title: "Storm-0501 Threat Identified, HTML Smuggling DCRat, CISA Releases Toolkit, Cybersecurity News [September 30, 2024] | DuoCircle"
description: "Storm-0501 Threat Identified, HTML Smuggling DCRat, CISA Releases Toolkit, Cybersecurity News [September 30."
image: "https://www.duocircle.com/images/og-default.png"
canonical: "https://www.duocircle.com/blog/announcements/cybersecurity-news-update-week-41-of-2024/"
---
Quick Answer
Cybersecurity news for the week of September 30, 2024\. Microsoft flagged Storm-0501 as a major hybrid-cloud ransomware actor, active since 2021 and now deploying Embargo (Rust-based) ransomware after using Impacket SecretsDump, Cobalt Strike, and Rclone to MegaSync. A new HTML smuggling campaign distributed DCRat malware to Russian-speaking users. CISA released an anonymous-threat-response toolkit for K-12 schools. A CUPS vulnerability was patched but rated less severe than initial reports suggested. NIST also revised its identity and password guidelines.
Storm-0501 Threat Identified, HTML Smuggling DCRat, CISA Releases Toolkit, Cybersecurity News \[September 30, 2024\]
Your browser does not support the audio element.
[ Download episode](https://media.mailhop.org/duocircle/images/2024/10/Storm-0501-Threat-Identified-HTML-Smuggling-DCRat-CISA-Releases-Toolkit-Cybersecurity-News-September-30-2024.mp3)
Share
[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fannouncements%2Fcybersecurity-news-update-week-41-of-2024%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=Storm-0501%20Threat%20Identified%2C%20HTML%20Smuggling%20DCRat%2C%20CISA%20Releases%20Toolkit%2C%20Cybersecurity%20News%20%5BSeptember%2030%2C%202024%5D&url=undefined%2Fblog%2Fannouncements%2Fcybersecurity-news-update-week-41-of-2024%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fannouncements%2Fcybersecurity-news-update-week-41-of-2024%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fannouncements%2Fcybersecurity-news-update-week-41-of-2024%2F&title=Storm-0501%20Threat%20Identified%2C%20HTML%20Smuggling%20DCRat%2C%20CISA%20Releases%20Toolkit%2C%20Cybersecurity%20News%20%5BSeptember%2030%2C%202024%5D "Share on Reddit") [ ](mailto:?subject=Storm-0501%20Threat%20Identified%2C%20HTML%20Smuggling%20DCRat%2C%20CISA%20Releases%20Toolkit%2C%20Cybersecurity%20News%20%5BSeptember%2030%2C%202024%5D&body=Check out this article: undefined%2Fblog%2Fannouncements%2Fcybersecurity-news-update-week-41-of-2024%2F "Share via Email")
We’re back to provide you with the latest [cybersecurity](/) news of the week, designed to keep you informed and secure against evolving threats. This week, we delve into Microsoft’s identification of Storm-0501 as a critical player in hybrid cloud ransomware attacks, a new HTML smuggling campaign distributing DCRat malware to [Russian-speaking users](https://www.infosecurity-magazine.com/news/russian-legitimate-services/), CISA’s release of a **new toolkit for K-12** schools to address anonymous threats, a recently patched but less severe vulnerability in CUPS, and NIST’s revisions to identity and password guidelines. Furthermore, let us now go through the details of each story.
## Microsoft Identifies Storm-0501 as a Major Threat in Hybrid Cloud Ransomware Attacks
[Microsoft has recently flagged Storm-0501](https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/), a financially motivated cybercriminal group, as a major player in [hybrid cloud ransomware attacks](https://thehackernews.com/2024/09/microsoft-identifies-storm-0501-as.html). _The malicious group primarily targets sectors like transportation, manufacturing, law enforcement, and government, mainly focusing on compromising hybrid cloud environments_. **Active since 2021, Storm-0501** has evolved into a caffiliate, delivering various ransomware payloads, including Hive, BlackCat, and LockBit.
Microsoft revealed that Storm-0501 exploits weak [credentials and over-privileged accounts](https://www.forbes.com/sites/louiscolumbus/2019/02/26/74-of-data-breaches-start-with-privileged-credential-abuse/) to gain unauthorized access to **on-premises networks**, which they then leverage to move into cloud infrastructure. Their campaigns typically result in data exfiltration, credential theft, and the deployment of ransomware, most recently using Embargo, a Rust-based ransomware.
Storm-0501’s attack methodology includes using initial access brokers like Storm-0249 and Storm-0900 or exploiting vulnerabilities in unpatched servers such as Zoho ManageEngine and Citrix NetScaler. After gaining access, they employ tools like Impacket’s SecretsDump to steal credentials and Cobalt Strike to move laterally across the network. [Data exfiltration](https://www.ibm.com/topics/data-exfiltration) is often conducted using Rclone to transfer files to public **cloud storage services** like MegaSync.
[](https://media.mailhop.org/duocircle/images/2024/10/spf-permerror-7412.jpg)
Microsoft has noted that while ransomware deployment is an expected outcome, Storm-0501 has also been observed to maintain **persistent backdoor** access without executing [ransomware](/resources/locky-ransomware) in some cases. _This significant discovery sheds light on the wide usage of ransomware attack tactics, specifically targeting hybrid cloud environments for monetary benefits_.
## New HTML Smuggling Campaign Delivers DCRat Malware to Russian-Speaking Users
A recent [cyber campaign targeting Russian-speaking users](https://thehackernews.com/2024/09/new-html-smuggling-campaign-delivers.html) has been detected, which seems to be utilizing a technique called HTML smuggling to deliver the commodity trojan DCRat (also known as DarkCrystal RAT). Previously, DCRat was distributed through **compromised websites** and [phishing emails](/content/phishing-prevention/phishing-email), but this marks the first time it has been delivered using HTML smuggling. This method involves embedding the [malicious payload](https://www.mcafee.com/blogs/other-blogs/mcafee-labs/rise-in-deceptive-pdf-the-gateway-to-malicious-payloads/) directly within an HTML file.
In the leading steps, these payloads can be decoded and downloaded when intentionally or unintentionally opened in a **web browser**. [Netskope researchers](https://www.netskope.com/blog/dcrat-targets-users-with-html-smuggling) identified that the attack relied on social engineering, tricking users into opening the malicious file that ultimately delivers the DCRat malware.
The campaign was found to mimic well-known Russian services like TrueConf and VK, distributing HTML files that automatically download password-protected ZIP archives containing the [DCRat malware](https://www.darkreading.com/threat-intelligence/five-buck-malware-worrying-cyber-future). Once executed, DCRat acts as a full-featured backdoor, allowing attackers to log keystrokes, execute commands, and steal sensitive information. The campaign demonstrates the increasing sophistication of malware delivery methods, particularly through HTML smuggling, which is harder to detect and block. Netskope has advised organizations to monitor [HTTP and HTTPS](https://www.bleepingcomputer.com/news/security/tors-new-webtunnel-bridges-mimic-https-traffic-to-evade-censorship/) traffic closely to avoid potential infections. For further insights, check out **Netskope’s research**.
## CISA Releases Anonymous Threat Response Guidance and Toolkit for K-12 Schools
The [Cybersecurity and Infrastructure Security Agency (CISA)](https://www.cisa.gov/news-events/news/cisa-releases-anonymous-threat-response-guidance-and-toolkit-k-12-schools) has launched a new [Anonymized Threat Response Toolkit](https://www.cisa.gov/sites/default/files/2024-09/ATRGToolkit508.pdf) aimed at helping K-12 schools handle anonymous threats of violence, particularly those spread through social media. Developed in partnership with the FBI, the toolkit offers a structured approach for school administrators, **law enforcement, and community partners** to respond to and mitigate the risks posed by anonymous threats.
The resource provides actionable strategies for assessing the credibility of threats, preparing for potential incidents, and coordinating responses with local partners. The toolkit aims to **reduce the psychological impact** of these threats on school communities while improving safety.
According to CISA Director Jen Easterly, schools across the country are dealing with a growing number of [anonymous threats](https://campussecuritytoday.com/Articles/2024/10/04/CISA-Releases-Anonymous-Threat-Response-Guidance-and-Toolkit-for-K12-Schools.aspx) that can disrupt learning environments and overwhelm resources. The toolkit outlines six key strategies, including building awareness, forming partnerships with law enforcement, and developing multidisciplinary threat assessment teams. It also emphasizes the importance of **practicing emergency management exercises** to ensure schools are prepared for threats at any time. The initiative was announced at CISA’s 2024 National Summit on K-12 School Safety and Security. For more information, visit the CISA website.
## Patch for CUPS Vulnerability Less Critical Than Anticipated
Earlier this month, a potentially [critical vulnerability was discovered in CUPS](https://isc.sans.edu/diary/Patch+for+Critical+CUPS+vulnerability+Dont+Panic/31302) (Common UNIX Printing System), which serves as the printing framework for many Linux distributions. This flaw in the earlier stages was identified as a **high severity rating**. The vulnerability was later downgraded since further analysis revealed [the vulnerabilities](https://www.rapid7.com/blog/post/2024/09/26/etr-multiple-vulnerabilities-in-common-unix-printing-system-cups/) were less critical than first anticipated.
_The vulnerabilities affected multiple Linux systems and, if exploited, could allow unauthenticated remote code execution_. The vulnerabilities or risks involved crafting malicious modified and altered packets and sending them to UDP port 631, which paved the pathway for the [cyber attack](https://www.bbc.com/news/world-us-canada-57703836). However, they still posed a significant risk to unpatched software and critical systems, impacting their **efficient operations and throughput**.
The CUPS vulnerabilities were addressed in a patch released by the Linux Openprinting project on September 26\. Experts have recommended that administrators [block inbound traffic](https://news.sophos.com/en-us/2023/06/20/asus-warns-router-customers-patch-now-or-block-all-inbound-requests/) to UDP port 631 and disable unnecessary services like **cups-browsed until updates** are applied. The patched vulnerabilities now have CVSS scores ranging from 8.4 to 9.1\. This news case highlights the importance of continuous monitoring and timely patching in Linux environments to prevent exploitation.
## NIST Revises Identity Guidelines, Including Password Requirements
[NIST (The National Institute of Standards and Technology)](https://en.wikipedia.org/wiki/National%5FInstitute%5Fof%5FStandards%5Fand%5FTechnology) has released an updated draft of its identity and password guidelines in Special Publication 800-63-4\. Several key amendments have been made to the draft, mainly addressing authentication practices for **government information systems**. Also, keen attention was paid, cloud storage services, Multifactor Authentication (MFA), and user privacy (need of the hour). It had significantly simplified the password rules, the new guidelines recommending:
[](https://media.mailhop.org/duocircle/images/2024/10/dkim-validation-1.jpg)
1. _The password length should be eight characters (minimum)_.
2. Passwords must be between 15 and 64 characters.
3. The use of special characters is not mandatory.
The updated NIST draft highly promotes the use of [phishing-resistant MFA](https://www.securityweek.com/cisa-urges-organizations-implement-phishing-resistant-mfa/) (Multifactor Authentication), which proves to be a more secure option rather than using reusable passwords. As per the recommendations of NIST, one must not practice using **knowledge-based credentials** like security questions and publicly visible password hints as these security options are now considered old and vague and remain more prone to sophisticated modern attacks, eventually making your [digital landscape](https://www.forbes.com/councils/forbestechcouncil/2024/04/10/what-you-should-know-to-effectively-navigate-the-digital-landscape/) insecure.
_These updates and changes represent the urge or need to shift toward more practical and user-friendly security practices_. Additionally, they encourage organizations to adopt more [robust authentication](https://fastercapital.com/keyword/robust-authentication.html) measures to keep their information systems secure.
## Topics
cyber securityUpdates
Brad Slavin
General Manager
General Manager at DuoCircle. Product strategy and commercial lead across the email security portfolio.
## Secure your email infrastructure
Protect, authenticate, and deliver. Contact our team to find the right solution.
[Contact Sales](/contact/) [Explore Products](/products/)
Share this article
[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcybersecurity-news-update-week-41-of-2024%2F) [ ](https://twitter.com/intent/tweet?text=Storm-0501%20Threat%20Identified%2C%20HTML%20Smuggling%20DCRat%2C%20CISA%20Releases%20Toolkit%2C%20Cybersecurity%20News%20%5BSeptember%2030%2C%202024%5D&url=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcybersecurity-news-update-week-41-of-2024%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.duocircle.com%2Fblog%2Fannouncements%2Fcybersecurity-news-update-week-41-of-2024%2F) Copy
Related Articles
- [  Microsoft Cybersecurity Transparency, Chrome Update Required, Google Calendar Phishing, Cybersecurity News \[December 23, 2024\] News ](/blog/announcements/cyber-security-news-update-week-1-of-2025/)
- [  Trust Wallet Hack, Browser Extension Espionage, Unleash Protocol Loss, Cybersecurity News \[December 29, 2025\] News ](/blog/announcements/cyber-security-news-update-week-1-of-2026/)
- [  Bybit’s $1.5B Loss, FatalRAT Hits APAC, GitVenom Targets Wallets,, Cybersecurity News \[February 24, 2025\] News ](/blog/announcements/cyber-security-news-update-week-10-of-2025/)
- [  LastPass Users Phished, Amazon Down US, UK Cybersecurity Boost, Cybersecurity News \[March 02, 2026\] News ](/blog/announcements/cyber-security-news-update-week-10-of-2026/)
## Related Articles
[ News 6m Microsoft Cybersecurity Transparency, Chrome Update Required, Google Calendar Phishing, Cybersecurity News \[December 23, 2024\] Jan 2, 2025 ](/blog/announcements/cyber-security-news-update-week-1-of-2025/)[ News 6m Trust Wallet Hack, Browser Extension Espionage, Unleash Protocol Loss, Cybersecurity News \[December 29, 2025\] Jan 5, 2026 ](/blog/announcements/cyber-security-news-update-week-1-of-2026/)[ News 7m Bybit’s $1.5B Loss, FatalRAT Hits APAC, GitVenom Targets Wallets,, Cybersecurity News \[February 24, 2025\] Mar 3, 2025 ](/blog/announcements/cyber-security-news-update-week-10-of-2025/)[ News 6m LastPass Users Phished, Amazon Down US, UK Cybersecurity Boost, Cybersecurity News \[March 02, 2026\] Mar 9, 2026 ](/blog/announcements/cyber-security-news-update-week-10-of-2026/)
```json
{"@context":"https://schema.org","@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}],"sameAs":["https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.facebook.com/duocirclellc","https://www.g2.com/products/phish-protection-by-duocircle/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://support.duocircle.com"},"knowsAbout":["Email Security","Email Authentication","SPF","DKIM","DMARC","Phishing Protection","Spam Filtering","SMTP Relay","Email Deliverability","Email Forwarding"]}
```
```json
{"@context":"https://schema.org","@type":"WebSite","name":"DuoCircle LLC","url":"https://www.duocircle.com","description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}
```
```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"Storm-0501 Threat Identified, HTML Smuggling DCRat, CISA Releases Toolkit, Cybersecurity News [September 30, 2024]","description":"Storm-0501 Threat Identified, HTML Smuggling DCRat, CISA Releases Toolkit, Cybersecurity News [September 30.","url":"https://www.duocircle.com/blog/announcements/cybersecurity-news-update-week-41-of-2024/","datePublished":"2024-10-07T20:04:24.000Z","dateModified":"2025-09-01T13:13:55.000Z","dateCreated":"2024-10-07T20:04:24.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cybersecurity-news-update-week-41-of-2024/"},"articleSection":"announcements","keywords":"cyber security, Updates","wordCount":1142,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/10/dmarc-report-2.jpg","caption":"Cybersecurity News","width":900,"height":506},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}},{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":2,"name":"News"},{"@type":"ListItem","position":3,"name":"Storm-0501 Threat Identified, HTML Smuggling DCRat, CISA Releases Toolkit, Cybersecurity News [September 30, 2024]","item":"https://www.duocircle.com/blog/announcements/cybersecurity-news-update-week-41-of-2024/"}]}]
```
```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.duocircle.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://www.duocircle.com/blog/"},{"@type":"ListItem","position":3,"name":"News","item":"https://www.duocircle.comundefined"},{"@type":"ListItem","position":4,"name":"Storm-0501 Threat Identified, HTML Smuggling DCRat, CISA Releases Toolkit, Cybersecurity News [September 30, 2024]","item":"https://www.duocircle.com/blog/announcements/cybersecurity-news-update-week-41-of-2024/"}]}
```
```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"Storm-0501 Threat Identified, HTML Smuggling DCRat, CISA Releases Toolkit, Cybersecurity News [September 30, 2024]","description":"Storm-0501 Threat Identified, HTML Smuggling DCRat, CISA Releases Toolkit, Cybersecurity News [September 30.","url":"https://www.duocircle.com/blog/announcements/cybersecurity-news-update-week-41-of-2024/","datePublished":"2024-10-07T20:04:24.000Z","dateModified":"2025-09-01T13:13:55.000Z","dateCreated":"2024-10-07T20:04:24.000Z","author":{"@type":"Person","@id":"https://www.duocircle.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://www.duocircle.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin runs DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. His focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","name":"DuoCircle LLC","url":"https://www.duocircle.com","logo":{"@type":"ImageObject","url":"https://www.duocircle.com/images/duocircle-logo.png"},"description":"DuoCircle is a portfolio of specialized email products covering protection, authentication, delivery, and routing. We deliver about 90% of category-leader capability at roughly half the price, backed by experts who own the outcome. Trusted by 50,000+ organizations since 2014.","subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://www.duocircle.com/blog/announcements/cybersecurity-news-update-week-41-of-2024/"},"articleSection":"announcements","keywords":"cyber security, Updates","wordCount":1142,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/duocircle/images/2024/10/dmarc-report-2.jpg","caption":"Cybersecurity News","width":900,"height":506},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```