stormous Ransomware
Tracked since Mar 22, 2022
0
victims recorded
0
in the last 30 days
0
CVEs
—
Last activity
Stormous is an Arabic-speaking, pro-Russian ransomware and hacktivist group active since at least 2022, known for politically motivated attacks across 15+ countries, collaborating with GhostSec on the GhostLocker 2.0 RaaS platform and inheriting GhostSec's RaaS operations in mid-2024.
On 1st July 2026 the group has annonced the end of their operations & ervices
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
No CVE associated with this group in the sources.
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1566 PhishingT1566.001 Phishing: Spearphishing Attachment Execution
T1059 Command and Scripting InterpreterT1059.005 Command and Scripting Interpreter: Visual BasicT1204.002 User Execution: Malicious File Persistence
T1053 Scheduled Task/JobT1098 Account ManipulationT1505.003 Server Software Component: Web ShellT1543.003 Create or Modify System Process: Windows ServiceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Privilege Escalation
T1548.002 Abuse Elevation Control Mechanism: Bypass UAC Defense Evasion
T1027 Obfuscated Files or InformationT1027.002 Obfuscated Files or Information: Software PackingT1027.011 Obfuscated Files or Information: Fileless StorageT1027.013 Obfuscated Files or Information: Encrypted/Encoded FileT1070 Indicator RemovalT1562.001 Impair Defenses: Disable or Modify Tools Credential Access
T1003 OS Credential Dumping Discovery
T1046 Network Service DiscoveryT1083 File and Directory Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin Shares Collection
T1005 Data from Local SystemT1560 Archive Collected Data Exfiltration
T1041 Exfiltration Over C2 ChannelT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1071.001 Application Layer Protocol: Web Protocols Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Resource Development
T1588.002 Obtain Capabilities: Tool Reconnaissance
T1595 Active Scanning Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live