Stormous Ransomware Group

Overview

Stormous first surfaced in mid-2021 and gained broader visibility in early 2022 when the group declared public support for Russia following the invasion of Ukraine. The group describes itself as an Arabic-speaking collective and has stated its objective as attacking targets in the United States and other Western nations perceived as adversarial to Russia. This political framing, combined with aggressive Telegram-based self-promotion, drew early attention — and significant skepticism — from the security research community.

Early skepticism centered on what researchers described as "scavenger operations": Stormous was suspected of repurposing data already stolen or leaked by other ransomware groups, then presenting it as a new breach to build notoriety and attract buyers. Trustwave SpiderLabs analysts described the group's posture as clout-driven, and Recorded Future's Alan Liska characterized the group as known to be "a bit of a clown show." The group's ransom notes are written in Arabic, and initial assessments pointed to members located in Middle Eastern countries and Russia, with two members reportedly arrested from Mid-Eastern nations.

Despite this early skepticism, Stormous matured its operations through 2023 and 2024. The group launched StormousX, its own ransomware payload, and in 2023 forged a significant partnership with GhostSec. Together they conducted double-extortion attacks across more than 15 countries, and in February 2024 formally launched STMX_GhostLocker, a joint RaaS platform offering both GhostLocker 2.0 (Golang) and StormCry (Python) payloads to affiliates through a dark-web management panel. When GhostSec exited ransomware operations in May 2024, Stormous absorbed GhostLocker's source code, management infrastructure, and affiliate relationships, subsequently launching the Stormous RaaS program as a continuation.

Stormous remains active as of early 2025. In May 2025 the group leaked a credential dump targeting multiple French government agencies. A May 2025 hospitality supply chain attack on HyperGuest's hotel-booking API resulted in over 30,000 plaintext payment card records and internal reservation data being exfiltrated.

Target Profile

Stormous targeting is shaped by a combination of political ideology and financial opportunism. The group prioritizes Western and NATO-aligned nations, but its ransomware operations — especially through the STMX_GhostLocker affiliate program — reach a much broader geographic and sectoral scope.

• United States: Primary declared ideological target. Stormous has claimed attacks on Coca-Cola, Mattel, Danaher, Epic Games, and several dozen other US companies, though many of these claims remain unverified. The US accounts for a substantial share of its data leak site listings.
• Ukraine and NATO allies: The group claimed to have breached the Ukrainian Ministry of Foreign Affairs, exfiltrating phone numbers, emails, passwords, and national identity card data. Western European governments, including French agencies, have been targeted in 2025.
• Manufacturing: The 2024 Duvel Moortgat brewery attack is the group's most publicly confirmed confirmed incident, shutting down beer production and stealing 88 GB of company and employee data.
• Hospitality and Supply Chain: The May 2025 HyperGuest hotel-booking API compromise demonstrates a shift toward trusted-relationship attacks targeting supply chain intermediaries rather than direct victim exploitation.
• Government entities: Multiple government ministries across Ukraine, Vietnam, Brazil, and France have been claimed or confirmed as targets in various phases of operations.
• Energy, Finance, and Healthcare: Ransomware-phase operations through STMX_GhostLocker reached energy suppliers, financial institutions, and healthcare firms globally via affiliate-driven campaigns.

Tactics, Techniques & Procedures

Stormous combines politically themed initial access lures with commodity ransomware execution, living-off-the-land techniques, and aggressive double-extortion. The following TTPs are drawn from Trustwave, Red Piranha, and Daily Security Review research on confirmed Stormous campaigns.

mitre id	technique	description
T1566.001	Phishing: Spearphishing Attachment	Phishing emails used for initial access, including lures pretending to be Ukraine war relief organizations and politically themed messages aligned with current geopolitical events.
T1190	Exploit Public-Facing Application	Unpatched web applications, VPN servers, and RDP endpoints are targeted for initial access. Credential stuffing and brute force against exposed RDP/VPN portals is observed.
T1078	Valid Accounts	Reused or weak credentials exploited for initial access. The HyperGuest supply chain attack involved entry through a trusted API relationship rather than a direct exploit, mapping to Trusted Relationship (T1199).
T1059	Command and Scripting Interpreter	Scripts are used to disable Windows Defender, kill EDR processes, and execute pre-encryption setup tasks. Ransom notes in HTML format sometimes pull content from Pastebin URLs at runtime.
T1021.002	Remote Services: SMB/Windows Admin Shares	SMB shares and PsExec are used to push ransomware payloads laterally across victim networks after initial compromise.
T1003.003	OS Credential Dumping: NTDS	Mimikatz is deployed to extract cached credentials from memory. NTDS.dit extraction from Active Directory is used to escalate privileges and move laterally across enterprise environments.
T1048	Exfiltration Over Alternative Protocol	Data is compressed using WinRAR or 7-Zip and staged for exfiltration to attacker-controlled servers or cloud drives via FTP. Double-extortion threat follows exfiltration confirmation.
T1486	Data Encrypted for Impact	StormousX and GhostLocker 2.0 payloads encrypt victim files. Stormous payloads append .ghost extension (when using GhostLocker). Backup deletion and shadow copy removal are configured in the RaaS builder prior to encryption.
T1562.001	Impair Defenses: Disable or Modify Tools	Scripts disable Windows Defender and EDR agents before ransomware execution. DLL sideloading and exploitation of vulnerable drivers are also observed for defense evasion.
T1491.001	Defacement: Internal Defacement	In politically motivated campaigns, website defacement with pro-Russia or ideological messages accompanies or replaces ransomware deployment.

Known Campaigns

Tools & Infrastructure

Stormous's tooling spans its own ransomware payload, shared GhostLocker infrastructure, and commodity living-off-the-land techniques for lateral movement and credential access.

• StormousX: Stormous's proprietary ransomware payload. Ransom notes are written in Arabic. Exact encryption algorithm details are not fully public, but operational behavior mirrors GhostLocker patterns including pre-encryption process termination and double-extortion sequencing.
• StormCry: Python-based ransomware payload offered to STMX_GhostLocker affiliates alongside GhostLocker 2.0 as a dual-locker option within the affiliate builder.
• GhostLocker 2.0 (inherited): Following GhostSec's exit in May 2024, Stormous absorbed GhostLocker's source code (v3), affiliates, and infrastructure. The Stormous RaaS program is a continuation of STMX_GhostLocker with GhostLocker at its core.
• PHP-based C2 Panels: Stormous uses custom PHP remote access panels for command-and-control, supplemented by Telegram bot alerts that notify affiliates when infections are active.
• Mimikatz: Deployed for credential dumping from memory; used alongside NTDS.dit extraction to harvest enterprise credentials for lateral movement.
• WinRAR / 7-Zip: Data compression tools used to stage exfiltrated files before transfer to attacker-controlled infrastructure via FTP or cloud uploads.
• LOLBins (Living-Off-the-Land Binaries): regsvr32.exe and other signed Windows binaries are used for stealthy execution to avoid signature-based detection. PsExec is used for ransomware distribution across SMB shares.
• Cobalt Strike: Post-exploitation loaders including Cobalt Strike beacons have been observed in Stormous-related campaigns by Red Piranha threat intelligence.
• Data Leak Site: Stormous operates a Tor-hosted dark-web blog for victim naming, data auctions, and affiliate management. Victims who decline to pay are publicly listed alongside samples of stolen data.

Indicators of Compromise

IOCs for Stormous are closely overlapping with GhostSec and STMX_GhostLocker infrastructure due to the shared RaaS platform. Indicators below reflect confirmed patterns from Cisco Talos, Red Piranha, and Trustwave SpiderLabs research.

Mitigation & Defense

Stormous's attack chain combines multiple entry vectors — phishing, credential stuffing, RDP brute force, and supply chain trust abuse — with a well-documented post-compromise playbook. Defense-in-depth across all of these vectors is required.

• RDP and VPN Hardening: Stormous frequently exploits exposed RDP and VPN portals with brute force and credential stuffing. Disable RDP where not required. Where required, place behind a VPN with MFA enforced. Implement account lockout policies and IP allowlisting. Audit VPN credentials for reuse across services.
• Phishing-Resistant MFA: Politically themed phishing lures are a primary initial access vector. FIDO2/WebAuthn hardware keys for privileged accounts are the only control that meaningfully resists adversary-in-the-middle phishing toolkits. Push-based MFA remains susceptible to social engineering.
• Patch Management and Vulnerability Prioritization: Stormous targets unpatched public-facing applications. Maintain a vulnerability management program that prioritizes internet-facing assets and tracks CISA KEV entries for active exploitation. Segregate internet-facing systems from internal networks.
• Credential Hygiene and Privileged Access Management: Mimikatz and NTDS.dit extraction are used to escalate privileges. Implement credential guard on Windows endpoints, enforce tiered administration, and audit for weak or shared credentials in Active Directory. Rotate credentials following any suspected compromise.
• Offline and Immutable Backups: Stormous payloads are configured to delete shadow copies and backups. Maintain offline, tested backups that cannot be reached from the network during an active intrusion. Test recovery procedures against realistic ransomware scenarios.
• Network Segmentation and Lateral Movement Controls: PsExec and SMB are used for ransomware distribution across victim networks. Segment networks to limit lateral movement. Restrict PsExec, disable unnecessary SMB shares, and monitor for bulk file access events consistent with encryption activity.
• Supply Chain and Third-Party API Risk: The HyperGuest attack demonstrates that trusted third-party integrations are an active entry vector. Audit API integrations for least-privilege access, monitor third-party connections for anomalous behavior, and require security attestation from supply chain partners.
• Threat Intelligence Monitoring: Stormous operates publicly via Telegram and maintains a dark-web data leak site. Monitoring these channels provides advance warning of targeting intentions and can identify when an organization's data or partners have been claimed, enabling faster incident response.

Sources & Further Reading

Attribution and references used to build this profile.

• Trustwave SpiderLabs — Stormous: The Pro-Russian, Clout Hungry Ransomware Gang (2022)
• Cisco Talos — GhostSec's Joint Ransomware Operation and Evolution of Their Arsenal (2024)
• Daily Security Review — Stormous Ransomware: The Pro-Russian Cyber Gang (2025)
• Red Piranha — Threat Intelligence Report: Stormous Activity May 2025 (2025)
• Tech Monitor — Coca-Cola Hack: Is Stormous Breach Genuine? (2022)
• TheSec Master — Stormous Ransomware: Analysis of Cybercrime Group (2025)
• Rapid7 — From Ideology to Financial Gain: Hacktivism to Cybercrime (2025)