Ransomware needs a way in. Stolen credentials are the cheapest one.
stormous Ransomware Group
Ransomware group profile
Description
Stormous is a pro-Russian cybercriminal group known for its ransomware attacks and data exfiltration, employing double extortion tactics. They primarily target organizations in the United States, Ukraine, and Europe, focusing on sectors such as government, healthcare, and telecommunications. The group operates under a Ransomware-as-a-Service model, enabling affiliates to utilize their tools extensively.
Key insights
- •Stormous employs double extortion tactics, encrypting and threatening to leak sensitive data.
- •Targets include government, healthcare, energy, and telecommunications sectors.
- •The group utilizes both custom and publicly available tools, often exploiting unpatched vulnerabilities.
- •They primarily operate through a Ransomware-as-a-Service (RaaS) model.
- •Recent attacks include significant data breaches affecting hundreds of thousands of individuals.
- •Stormous claims alignment with Russian geopolitical interests and focuses on Western countries.
Threat Level & Status Breakdown
For stormous · Based on incidents in selected period
Status Breakdown
Recent activity
Monthly attack count for stormous in the selected period
Intelligence
IOCs, YARA/Sigma rules, and related families for stormous
- d4f71fc5479a02c8ff57c90fc67b948adb5604e0
- 8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9
- 12b818950d749c378aabd81a0bac9742
- 8cee3ec87a5728be17f838f526d7ef3a842ce8956fe101ed247a5eb1494c579d
- e014c9e5f712775e771c7f36d2a580d8d290c9ad
- f001329114937fbc439f251c803ba825
- 95ae81de52655fac3f1b226f1896690566090640
- a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f
- 3afd36e7e837d7216bdb48e466f8dcd5f2b169b6
- 2a720281cd869c1aaaca430a96cf980f623e0f76
- 1b4b4e910bfd31f5f3f2f3a269bf2c994978b78a
- b15a8047abd9a3af013cf6c77ce15acf
- 96ba3ba94db07e895090cdaca701a922523649cf6d6801b358c5ff62416be9fa
- 111caef54a6bb02a11d8c6f923e5c8b1f2323eb3
- aa62afd6a48d3c42ed66d4f5b9189be847ec055b
- 8ad67a1b7a5f2428c93f7a13a398e39c
- 0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for stormous
T1486
T1486
T1490
T1490
T1078
T1078
T1021
T1021
T1562
T1562
T1059
T1059
T1547
T1547
T1021.001
T1021.001
T1210
T1210
T1005
T1005
T1105
T1105
T1041
T1041
Victims(58)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Notice | — | Claimed | 3 months ago | |
| Monoprix Tunisie | Tunisia | Claimed | 3 months ago | |
| 株式会社 樋口商会 (英語：HIGUCHI INC.) | Japan | Claimed | 3 months ago | |
| eshacloudqa.com | United States | Claimed | 3 months ago | |
| eogb.co.uk | United Kingdom | Claimed | 3 months ago | |
| Higuchi, Inc. | United States | Claimed | 3 months ago | |
| Palatine School | United Kingdom | Data Leaked | 3 months ago | |
| Data Leak Update | — | Claimed | 3 months ago | |
| montechiaro-store.com | Italy | Claimed | 3 months ago | |
| Lorenzoni Store | Italy | Claimed | 3 months ago | |
| Impulso Store | Mexico | Claimed | 3 months ago | |
| Maglificio Liliana | Italy | Claimed | 3 months ago | |
| JAG Group | United States | Claimed | 3 months ago | |
| MLIT | Malaysia | Data Leaked | 3 months ago | |
| mlit.com.my | Malaysia | Data Leaked | 3 months ago | |
| SA2000 | — | Claimed | 3 months ago | |
| Service Alimentaire 2000 | Saudi Arabia | Claimed | 4 months ago | |
| Katholiek Amersfoort | Netherlands | Claimed | 4 months ago | |
| Important Announcement | — | Claimed | 4 months ago | |
| VPN Access Sale | — | Claimed | 4 months ago |
Page 1 of 3
Affected countries(74)
Countries where this group has been reported to target or leak victims.