Attribution
Assessed by Microsoft as a Gaza-based threat actor working to further the interests of Hamas (the de facto governing authority in the Gaza Strip). Attribution rests on victimology (targets are entities perceived as hostile to Hamas) rather than disclosed technical linkage. The 'Storm-####' designation is Microsoft's own convention for a cluster in development / temporary group with uncertain or not-yet-consolidated attribution, so the Hamas alignment should be read as a Microsoft assessment, not a settled multi-source consensus. Confidence: low-to-medium (single primary source, plausible and internally consistent).
Origin
Palestinian Territories (Gaza Strip)
Motivation
Espionage / intelligence collection aligned with Hamas geopolitical interests, targeting organizations and factions perceived as hostile to Hamas.
Attribution confidence
medium
Sectors
Energy, defense, telecommunications
Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel (Energy, defense, telecommunications sectors).
What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.
No open hunts or recent alerts tracked against this actor right now.