Loading malware…
Storm Worm was a Windows-focused peer-to-peer malware and spam botnet active primarily from 2007 until its apparent abandonment in September 2008. It propagated through social-engineering campaigns, notably malicious email messages posing as e-cards or news alerts, and later through malicious web pages. Its fast-flux infrastructure used compromised systems to host delivery content, complicating conventional infrastructure takedowns. Storm used encrypted peer-to-peer command-and-control communications, rapidly deployed variants to hinder signature-based detection, and was used to distribute spam at substantial scale. It also possessed a self-defensive capability that directed distributed denial-of-service traffic against systems that scanned infected hosts or attempted remediation. U.S. authorities alleged that Russian spam operator Peter Yuryevich Levashov controlled and operated Storm among other botnets. Storm is regarded as an early prominent public example of a peer-to-peer botnet; it is distinct from unrelated malware operations that have also used the name Storm.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The Department of Justice said that Levashov “controlled and operated multiple botnets, including the Storm, Waledac, and Kelihos botnets to harvest personal information and means of identification (including email addresses, usernames and logins, and passwords) from infected computers.”
Its main brand is the notorious ‘Canadian Pharmacy’, which is all too familiar to everyone through massive email spam campaigns that seem never to end.
The members of SpamIt are allegedly the group behind the Storm, Waledec and potentially Conficker botnets, responsible for email distribution and fast-flux hosting of the spam websites
Feed in a Google Refresh Token and a geographically matched SOCKS5 proxy, and the panel silently restores the victim's authenticated session.
Origins P2P networks are more scalable and robust than traditional C/S structures, and these advantages were recognized by the botnet authors early on and used in their botnets.
“For over two decades, Peter Levashov operated botnets which enabled him to harvest personal information from infected computers, disseminate spam, and distribute malware used to facilitate multiple scams,” said Assistant Attorney General Brian Benczkowski in a statement.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware operation cited as an example of AI-focused marketing claims; the content does not validate those claims.
Referenced only as a comparison family that did not technically match the observed sample.
A worm-associated botnet used for large-scale spam and DDoS activity. The content describes it as capable of launching distributed denial-of-service attacks against systems scanning for vulnerabilities or malware, and notes its operators also shifted from email lures to malicious web pages.
Storm is an infostealer that harvests browser credentials, session cookies, crypto wallets, documents, messaging app session data, system information, and screenshots. It avoids local browser credential decryption by exfiltrating encrypted browser data to attacker-controlled infrastructure for server-side decryption, and supports automated session restoration using stolen tokens and proxies.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.