stormous Ransomware
Monitorado desde 22/03/2022
0
vítimas registradas
0
nos últimos 30 dias
0
CVEs
—
Última atividade
Stormous is an Arabic-speaking, pro-Russian ransomware and hacktivist group active since at least 2022, known for politically motivated attacks across 15+ countries, collaborating with GhostSec on the GhostLocker 2.0 RaaS platform and inheriting GhostSec's RaaS operations in mid-2024.
On 1st July 2026 the group has annonced the end of their operations & ervices
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
Nenhuma CVE associada a este grupo nas fontes.
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1199 Trusted RelationshipT1566 PhishingT1566.001 Phishing: Spearphishing Attachment Execution
T1059 Command and Scripting InterpreterT1059.005 Command and Scripting Interpreter: Visual BasicT1204.002 User Execution: Malicious File Persistence
T1053 Scheduled Task/JobT1098 Account ManipulationT1505.003 Server Software Component: Web ShellT1543.003 Create or Modify System Process: Windows ServiceT1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder Privilege Escalation
T1548.002 Abuse Elevation Control Mechanism: Bypass UAC Defense Evasion
T1027 Obfuscated Files or InformationT1027.002 Obfuscated Files or Information: Software PackingT1027.011 Obfuscated Files or Information: Fileless StorageT1027.013 Obfuscated Files or Information: Encrypted/Encoded FileT1070 Indicator RemovalT1562.001 Impair Defenses: Disable or Modify Tools Credential Access
T1003 OS Credential Dumping Discovery
T1046 Network Service DiscoveryT1083 File and Directory Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin Shares Collection
T1005 Data from Local SystemT1560 Archive Collected Data Exfiltration
T1041 Exfiltration Over C2 ChannelT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1071.001 Application Layer Protocol: Web Protocols Impact
T1486 Data Encrypted for ImpactT1490 Inhibit System Recovery Resource Development
T1588.002 Obtain Capabilities: Tool Reconnaissance
T1595 Active Scanning Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live