stormous

189 tracked victims

·first seen 2022-03-22·last activity 2026-07-01

Group profile

Stormous is an Arabic-speaking, pro-Russian ransomware and hacktivist group active since at least 2022, known for politically motivated attacks across 15+ countries, collaborating with GhostSec on the GhostLocker 2.0 RaaS platform and inheriting GhostSec's RaaS operations in mid-2024. On 1st July 2026 the group has annonced the end of their operations & ervices

MITRE ATT&CK TTPs

TA0001

Initial Access

T1078Valid Accounts
T1190Exploit Public-Facing Application
T1199Trusted Relationship
T1566Phishing
T1566.001Phishing: Spearphishing Attachment

TA0002

Execution

T1059Command and Scripting Interpreter
T1059.005Command and Scripting Interpreter: Visual Basic
T1204.002User Execution: Malicious File

TA0003

Persistence

T1053Scheduled Task/Job
T1098Account Manipulation
T1505.003Server Software Component: Web Shell
T1543.003Create or Modify System Process: Windows Service
T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

TA0004

Privilege Escalation

T1548.002Abuse Elevation Control Mechanism: Bypass UAC

TA0005

Defense Evasion

T1027Obfuscated Files or Information
T1027.002Obfuscated Files or Information: Software Packing
T1027.011Obfuscated Files or Information: Fileless Storage
T1027.013Obfuscated Files or Information: Encrypted/Encoded File
T1070Indicator Removal
T1562.001Impair Defenses: Disable or Modify Tools

TA0006

Credential Access

T1003OS Credential Dumping

TA0007

Discovery

T1046Network Service Discovery
T1083File and Directory Discovery

TA0008

Lateral Movement

T1021.001Remote Services: Remote Desktop Protocol
T1021.002Remote Services: SMB/Windows Admin Shares

TA0009

Collection

T1005Data from Local System
T1560Archive Collected Data

TA0010

Exfiltration

T1041Exfiltration Over C2 Channel
T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage

TA0011

Command and Control

T1071.001Application Layer Protocol: Web Protocols

TA0040

Impact

T1486Data Encrypted for Impact
T1490Inhibit System Recovery

TA0042

Resource Development

T1588.002Obtain Capabilities: Tool

TA0043

Reconnaissance

T1595Active Scanning

Recent victims

showing 50 of 188

Date	Website / victim	Sector	Country
2026-06-28	higuchi-inc.co.jphiguchi-inc.co.jp	Manufacturing	JP
2026-06-28	HIGUCHI USA, INChiguchiinc.com	Manufacturing	US
2026-06-28	eogb.co.ukeogb.co.uk	Energy & Utilities	GB
2026-06-28	eshacloudqa.comeshacloudqa.com	Technology	US
2026-06-28	monoprix.tnmonoprix.tn	Retail & E-Commerce	TN
2026-06-28	O Official Statement: Protecting palatineschool.org Infrastructure	Education
2026-06-24	maglificioliliana.commaglificioliliana.com	Not Found
2026-06-24	lorenzoni-store.comlorenzoni-store.com	Retail & E-Commerce	IT
2026-06-24	montechiaro-store.commontechiaro-store.com	Retail & E-Commerce	IT
2026-06-24	impulso-store.comimpulso-store.com	Retail & E-Commerce	MX
2026-06-20	J jaggroup.com UPDATE-FULL DATA DUMP	Not Found
2026-06-12	mlit.com.mymlit.com.my	Government & Defense	MY
2026-06-04	SA2000.COMSA2000.COM	Not Found	SA
2026-06-02	katholiekamersfoort.nlkatholiekamersfoort.nl	Education	NL
2026-05-13	ttt.vn UPDATE-FULL DATA DUMPttt.vn	Not Found	VN
2026-05-13	vspsolutions.com.au SAMPLE-FREE 20GBvspsolutions.com.au	Professional Services	AU
2026-05-11	arc-reins.com + fidelityunited.ae UPDATE-FULL DATA DUMPfidelityunited.ae	Financial Services	AE
2026-05-09	ams-group.co.uk FULL DATA DUMP 33GBams-group.co.uk	Professional Services	GB
2026-05-05	ttt.vn TTT Corporationttt.vn	Not Found	VN
2026-05-03	or-technology.comor-technology.com	Technology	DE
2026-05-03	FANASA.COMFANASA.COM	Retail & E-Commerce	MX
2026-05-03	cgcsa.co.zacgcsa.co.za	Professional Services	ZA
2026-05-01	arc-reins.com + fidelityunited.aefidelityunited.ae	Financial Services	AE
2025-12-08	www.goodmanmfg.comwww.goodmanmfg.com	Manufacturing	US
2025-12-08	www.futureal.huwww.futureal.hu	Other	HU
2025-12-08	www.bkcolombia.orgwww.bkcolombia.org	Other	CO
2025-12-08	www.holidaypalace.comwww.holidaypalace.com	Hospitality	KH
2025-11-09	! !	Not Found
2025-11-06	www.wilmar.co.idwww.wilmar.co.id	Agriculture and Food Production	ID
2025-11-06	www.danareksa.comwww.danareksa.com	Financial Services	ID
2025-11-06	www.marjane.mawww.marjane.ma	Retail & E-Commerce	MA
2025-05-23	F French Government	Government & Defense	FR
2025-05-31	Volkswagenvolkswagen-group.com	Manufacturing	DE
2025-10-27	usbmemorydirect.comusbmemorydirect.com	Technology	US
2025-10-27	www.sincroslab.comwww.sincroslab.com	Technology	ES
2025-10-27	www.visioninksltd.inwww.visioninksltd.in	Manufacturing	IN
2025-10-27	www.americanadecolchones.comwww.americanadecolchones.com	Retail & E-Commerce	CO
2025-10-27	www.francetravail.frwww.francetravail.fr	Government & Defense	FR
2025-07-13	North Country HealthCarench.org	Healthcare	US
2025-06-23	hy-vee.comhy-vee.com	Agriculture and Food Production	US
2025-06-14	bulentklise.com.trbulentklise.com.tr	Manufacturing	TR
2025-06-12	F French Gov "PYV S"	Government & Defense	FR
2025-06-12	F French Gov	Government & Defense	FR
2025-06-10	education.gouv.freducation.gouv.fr	Education	FR
2025-06-06	rinaldi.com.brrinaldi.com.br	Professional Services	BR
2025-05-31	Volkswagen Groupvolkswagen-group.com	Manufacturing	DE
2025-05-23	French Gov 2025ac-lyoun.fr	Government & Defense	FR
2025-05-21	www.seashoremotel.comwww.seashoremotel.com	Hospitality	US
2025-05-21	www.wirebangkok.comwww.wirebangkok.com	Technology	TH
2025-05-21	www.axxoshotels.comwww.axxoshotels.com	Hospitality	DE