Threat actor
Storm 1849
Attribution profile
- Type
- Spy
- Location
- China
- Known incidents
- 4 incidents
- Sources
- 0 sources
- First seen
- 2025-09-01
- Last seen
- 2025-12-22
- Updated
- 2026-10-03 01:56
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Storm 1849, a threat actor linked to China, has been publicly associated with cyber incidents targeting UK organizations, including an alleged breach of the Foreign, Commonwealth and Development Office involving confidential documents, a disruption of Marks & Spencer’s online ordering system, and a production‑halting cyber attack on Jaguar Land Rover. The available sources do not describe specific malware families, initial access vectors, or tooling details used by the actor, and attribution to a state or criminal group remains unconfirmed.
Incidents
Attributed incidents are available to members.
4 incidentsSources
Sources available to members: 0 sources.