Executive Summary
Huntress analyzed a lookalike WatchGuard SSL VPN download site, watchguard-vpn[.]net, reached through SEO poisoning of search results. Microsoft attributed a wider iteration of the campaign to Storm-2561, a financially motivated actor active since May 2025. Huntress does not publish its own attribution for the site.
The site asks for the VPN server, login and password. It rejects the first submission with "Incorrect data", which prompts a second entry. It then serves the genuine, validly signed WatchGuard installer from WatchGuard's own CDN. No malicious file is delivered, so endpoint tools have no file to flag.
The impact is exposed VPN credentials, which can give an attacker access to the organization's network. Rotate any credential entered on the site, enforce MFA on VPN access and download VPN clients only from the vendor's portal.