Storm-2755 Targets Canadian Employees in Payroll Diversion Scheme

Emergence of Storm-2755: A New Financially Motivated Threat Actor

In early April 2026, Microsoft Incident Response's Detection and Response Team (DART) identified a new financially motivated threat actor, designated as Storm-2755. This group has been actively compromising Canadian employee accounts to gain unauthorized access to payroll systems, diverting salary payments to accounts under their control. The discovery underscores the evolving tactics of cybercriminals targeting financial assets through sophisticated means.

Modus Operandi: Credential Compromise and Payroll Diversion

Storm-2755 employs a multi-faceted approach to infiltrate organizations:

• Credential Theft: Utilizing phishing campaigns and exploiting vulnerabilities, the group acquires legitimate employee credentials.
• Unauthorized Access: With these credentials, they access payroll systems, often bypassing traditional security measures.
• Salary Diversion: Once inside, they alter direct deposit information, redirecting salary payments to accounts they control.

This method not only results in financial loss for employees but also poses significant reputational risks for affected organizations.

Impacted Sectors and Organizations

While the full scope of Storm-2755's activities is still under investigation, initial reports indicate that multiple sectors have been targeted, including:

• Financial Services: Banks and credit unions have reported unauthorized access attempts.
• Healthcare: Hospitals and clinics have observed suspicious activities in their payroll systems.
• Education: Universities and colleges have detected anomalies in employee payment processes.

Organizations are urged to remain vigilant and monitor their payroll systems for unusual activities.

Mitigation Strategies and Recommendations

To defend against threats like Storm-2755, organizations should implement the following measures:

• Multi-Factor Authentication (MFA): Enforce MFA across all systems to add an extra layer of security.
• Regular Security Audits: Conduct periodic reviews of access logs and system configurations.
• Employee Training: Educate staff on recognizing phishing attempts and the importance of secure credential management.
• Incident Response Planning: Develop and regularly update response plans to address potential breaches promptly.

By adopting these strategies, organizations can enhance their resilience against such targeted attacks.

Conclusion

The emergence of Storm-2755 highlights the persistent and evolving nature of cyber threats targeting financial assets. Organizations, especially those in Canada, must prioritize cybersecurity measures to protect their employees and financial systems from such malicious activities.

For more detailed information on Storm-2755 and its activities, refer to the official Microsoft Security Blog post: Investigating Storm-2755: “Payroll pirate” attacks targeting Canadian employees.