STORM

Storm is a financially motivated ransomware-as-a-service operation that emerged publicly in August 2026. Its reported targets include organizations in the United States, Canada, Australia, and Germany, spanning business services, financial services and insurance, manufacturing, healthcare, retail, transportation, construction, government, and nonprofit services. Storm claimed more than 50 victims within approximately six weeks of its emergence; its leak-site listings are not equivalent to independently confirmed intrusions. Storm recruits affiliates, initial access brokers, data brokers, and network access providers. Its advertised affiliate program offers revenue shares ranging from 75% to 90% and ransomware lockers for Windows, Linux, ESXi, and network-attached storage systems. Advertised support includes victim negotiations, call center services, endpoint-security bypass assistance, distributed denial-of-service capabilities, and media outreach. These advertised services do not establish that each capability has been used in an intrusion. Storm operates a Tor-based data-leak site featuring searchable victim listings, an interactive victim map, industry filters, victim timelines, and document previews. It pressures alleged victims by threatening to publish purportedly stolen information when negotiations fail. Its marketing describes the operation as AI-powered and quantum-resistant, but those technical claims have not been substantiated. Its operators' geographic origin and specific intrusion methods are not established.