Storm
High-tempo extortion operation that surfaced in August 2026 and posted 61 claimed victims (59 distinct organizations) in six weeks, concentrated on US community banks, regional healthcare and manufacturers, including aerospace and defense suppliers.
New group, fast start, and a financial-sector focus
Storm is a financially motivated extortion group that runs a Tor data leak site and negotiates with victims over Tox. [2][3][4] Trackers classify it as a ransomware-as-a-service and data-broker operation using direct and double extortion. [2][3] Intruvent collection recorded its first leak-site postings on 07 August 2026 and 61 leak-site postings through 18 September 2026 (41 in August, 20 in September; 59 distinct organizations), 44 of them in the United States. [1] Intruvent collection runs through 18 September; other public trackers report 63 to 66 through 24 September. [2][4][5] No malware sample, ransom note, or encryptor has been publicly tied to this group as of 24 September 2026.
Storm posted 61 claimed victims (59 distinct organizations) in six weeks. Financial services and manufacturing each carry 13 victim tags, and healthcare carries 10. [1] The financial-services tags include seven US banks and credit unions, and the victim list also includes a city government, a defense contractor, and several manufacturers serving aerospace and defense customers. [1][7][8] Ransomware.live measures an average delay of 1.8 days between estimated attack date and leak-site posting, which leaves defenders little time between compromise and public extortion. [2] Between 19% and 33% of victims with identifiable domains had prior infostealer credential exposure, depending on the tracker. [2][5] Assessment (moderate confidence): Storm is among the more active new extortion brands of 2026 and will keep posting at a rate of several victims per week in the near term.
US community banks, credit unions, regional healthcare providers, and aerospace or defense suppliers should treat Storm as a tracking priority. Check corporate domains against infostealer feeds, enforce MFA on every remote access path, and confirm that detection covers bulk data staging and exfiltration (Section 06). Add the leak site and Tox IDs in Section 06 to monitoring for your organization and key suppliers. None of the published indicators are suitable for network blocking. Do not import Storm-1175 or StormEncryptor indicators as Storm indicators; no primary source links them (Section 02).
The HIGH rating reflects victim volume and the concentration on regulated financial and healthcare organizations, not novel tradecraft; no tradecraft has been publicly documented. A downgrade is warranted if posting stops for 30 days or more. Victim listings throughout this report are leak-site claims, not confirmed breaches. Bracketed markers, e.g. [1], point to the numbered sources in Section 08.
Unclustered and unattributed; operators and origin unknown
EF17A8BDCDD150FDFAA9EF5C6FB2EBB1CA1E858DD22ED6FD7485FB184493F1016029C05A9A4C [4]
DATA LEAK: yqhecvqtdvq6p7duqcgw2qca77spbgakxcoibtx6zpvfshltsbbbhfqd.onion
DISAMBIGUATION: THREE SIMILAR NAMES, NO ESTABLISHED LINK
Analyst guidance: Do not merge Storm-1175 or StormEncryptor indicators into Storm detections, and do not attribute Storm victims to Storm-1175. If a StormEncryptor note or binary ever appears with Storm's Tox IDs or leak site, this profile will be updated.
US-heavy, with banks, healthcare, and manufacturing on top
- Financial services (13) [1]
- Manufacturing (13) [1]
- Healthcare (10) [1]
- Other / untagged (8) [1]
- Technology (4) [1]
- Retail and e-commerce (3) [1]
- Professional services, transportation, government and defense, agriculture (2 each) [1]
- Education, energy and utilities (1 each) [1]
- United States (44) [1]
- Canada (7) [1]
- Australia (6) [1]
- Germany (3) [1]
- United Kingdom (1) [1]
- Seven US banks and credit unions [1]
- Regional hospitals, clinics, hospice, and specialty pharmacy [1]
- Foundries, tool and die, and metal fabrication [1]
- Aerospace and defense suppliers (four organizations) [1][7][8]
- Three law firms (US, Canada) [1]
- One US city government [1]
Counts use the sector tag recorded with each posting in Intruvent collection. [1] Tags contain errors: an engine-systems firm is tagged financial services, a veterinary practice is tagged healthcare, and one law firm is tagged "Other". Two companies appear twice, so the 61 postings cover 59 distinct organizations. [1] For comparison, other public trackers report financial services 14, manufacturing 13, and healthcare 11 (ransomware.live) and 14, 12, and 9 (Breachsense) through later dates. [2][5]
Regional cluster: Seven US victims are concentrated in two neighboring US states according to the leak-site descriptions and press coverage, spanning healthcare, defense, aerospace, and construction services. [1][7][8] Assessment (low confidence): this clustering may reflect a shared regional service provider or a single access supplier, or simply chance. No source reports a common access vector.
Defense industrial base note: Claimed victims include four US aerospace and defense suppliers: a defense contractor, a commercial aerospace repair firm, a power electronics maker with military customers, and an aerospace foundry. [1][7][8] Press reporting on one of these postings described leaked samples including technical schematics and possible employee identification documents. [7] External trackers show one further US aerospace and defense manufacturer posted after 18 September. [4]
Extortion model visible; intrusion tradecraft undocumented
No incident response report, malware analysis, or forensic writeup of a Storm intrusion has been published as of 24 September 2026. The register below is the minimum set supported by leak-site behavior. Rows marked INFERRED are Intruvent analytic mappings, not observed technique evidence.
Initial access for Storm intrusions is not publicly documented. Ransomware.live reports that 33.3% of victims with a known domain had infostealer exposure, and Breachsense reports that 19% (12 of 63) had employee credentials leak in the 12 months before posting. [2][5] Assessment (low confidence): stolen credentials (T1078, Valid Accounts) are a plausible entry route for some victims, but this is a hypothesis drawn from correlation, not a mapped technique. The Storm-1175 techniques in Section 02 (N-central exploitation, AnyDesk or SimpleHelp, Advanced IP Scanner, Mimikatz) belong to a different, unlinked actor and are deliberately excluded here. [9]
Six weeks, 13 posting days, 61 postings (59 organizations)
Earliest estimated attack date
Ransomware.live estimate for the first Storm victim. [2]
First postings
Seven victims posted on the first day Intruvent collection observed the leak site, spanning healthcare, legal, manufacturing, and banking. [1]
41 postings on 9 days
Postings arrived in batches of up to seven per day. [1]
Largest posting wave
Eight postings in one day, including a US aerospace supplier whose listing drew press coverage. [1][7][8]
Three banks in one batch
Five postings, including three US banks and a wealth manager. Last Storm record in Intruvent collection. [1]
Posting continues
Intruvent collection runs through 18 September; other public trackers report further postings on 21 and 24 September and totals of 63 to 66 through 24 September. [2][4][5] Ransomware.live measures attack velocity 44% below the prior month. [2]
The roll-up covers the 59 distinct organizations behind the 61 postings in Intruvent collection through 18 September, grouped by Intruvent from the posting descriptions. [1] The final row covers five organizations that other public trackers report were posted on 21 and 24 September. [2][4][6] Per Intruvent public-reporting policy, victim organizations are not named; the full list is held in Intruvent research files. Every count reflects the group's own claims. None of the organizations has publicly confirmed a Storm intrusion in the sources reviewed, and no claimed data volumes are available. Intruvent collection records 61 postings through 18 September; other public trackers report 63 to 66 through 24 September (Breachsense 63 through 22 September, ransomware.live 64 through 21 September, RansomLook 66 posts through 24 September). [1][2][4][5] GalaxyWarden lists 92 breaches but does not state its method, and Intruvent could not reconcile that figure. [6]
No blockable indicators; detect the behaviors
No file hashes, IP addresses, domains, ransom-note names, or encryptor artifacts are publicly attributed to Storm as of 24 September 2026. The three indicators below identify the group's extortion channel. They support leak-site monitoring and intelligence correlation, not network blocking. The StormEncryptor hashes and IP addresses that circulate under the Storm-1175 name are excluded (Section 02). [9][10]
Data leak site. Sources [1][2][3][4][5]. Confidence HIGH. Codex false-positive check negative. [11]INVESTIGATE / MONITOR
Negotiation contact. Sources [3][4]. Confidence HIGH (two trackers).INVESTIGATE / MONITOR
Second negotiation contact. Source [4]. Confidence MODERATE (single source).INVESTIGATE / MONITOR
Block, High Confidence: none. No Storm indicator meets the criteria. Alert/Monitor, Shared Infrastructure: none published; no IP, ASN, cloud, or VPN indicators exist for this group. Investigate, Unconfirmed: the onion address and both Tox IDs. Use them to monitor the leak site for your organization, subsidiaries, and suppliers, and to recognize the group in a ransom note or negotiation. A .onion address resolves only inside Tor and cannot be blocked by address at the network edge. Tox IDs are messaging identities, not network endpoints. Do not add these values to firewall or DNS block lists, and do not block Tor exit or relay ranges as a Storm countermeasure, because they are shared infrastructure.
The behaviors below are generic pre-encryption and exfiltration activity that applies to any extortion operation. None is specific to Storm, and none has been tested against Storm activity. Each carries the label DETECTION ONLY: expect legitimate matches and triage by an analyst, not automated blocking.
Eight actions for the sectors Storm is posting
Bracketed markers in the body point to the numbered sources below. All external sources accessed 24 SEP 2026 unless noted.
- Intruvent Technologies (Styx dark-web monitoring). Storm group record (id 3819) and 61 victim postings, 07 August to 18 September 2026; Stormous group record (id 94). Internal collection, canonical Styx database pulled 24 September 2026, newest record 21 September 2026. Sector counts use the tag recorded with each posting; banking, legal, aerospace, and regional groupings are Intruvent readings of the posting descriptions.
- Ransomware.live. Storm group page. ransomware.live/group/storm.
- WatchGuard Technologies. Storm Ransomware, Ransomware Tracker. watchguard.com/wgrd-security-hub/ransomware-tracker/storm.
- RansomLook. Storm group page. ransomlook.io/group/storm.
- Breachsense. Storm Ransomware: Victims and Activity. breachsense.com/ransomware-groups/storm.
- GalaxyWarden. Storm Ransomware Breach Tracker. galaxywarden.com/blog/threat/storm.
- Cybernews. Report on a September 2026 Storm claim against a US aerospace supplier. September 2026. URL withheld (names victim); held in Intruvent research files. [UNAVAILABLE: direct retrieval returned HTTP 403 on 24 September 2026; details cited here come from search-index excerpts of the article and should be read as secondhand.]
- DeXpose. Breach alert on a September 2026 Storm victim. 04 September 2026. URL withheld (names victim); held in Intruvent research files.
- The Hacker News. China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw. 10 August 2026, reporting Microsoft Threat Intelligence findings. thehackernews.com/2026/08/china-linked-hackers-deploy-new.html.
- FemtoSec. Storm Ransomware Targets Exposed RMM Infrastructure. 09 August 2026. femtosec.io/threat-intelligence/storm-ransomware-rmm-vulnerability-exploitation. Cited only to document an unsupported Storm and Storm-1175 conflation.
- Intruvent Codex (Golden CTI Database). Actor lookup, alias resolution (Storm, Stormous, Storm-1175, StormEncryptor), technique records T1657 and T1486, and false-positive check for the Storm onion. Queried 24 September 2026.
- RansomLook. Stormous group page (onion and Tox ID comparison). ransomlook.io/group/stormous.
- MITRE ATT&CK. T1657 Financial Theft; T1486 Data Encrypted for Impact. attack.mitre.org/techniques/T1657; attack.mitre.org/techniques/T1486.
v1.0.1 (24 SEP 2026): Victim names removed; victim listings replaced with sector aggregates per Intruvent public-reporting policy. Safety-label pictographs replaced with plain-text labels. Collection-source wording revised. v1.0 (24 SEP 2026): Initial release. Victim figures reflect Intruvent collection through 18 September 2026, with other public trackers' postings through 24 September 2026 noted separately.