Loading malware…
Storm is a Windows malware family first observed in January 2007 that built a large peer-to-peer botnet used for bulk spam distribution and distributed denial-of-service attacks. It spread through malicious emails using sensational news headlines, fake news alerts, and counterfeit electronic greeting cards. Its operators also used malicious web pages as an additional infection channel.
Storm used encrypted peer-to-peer command and control and a Kademlia-based distributed hash table to distribute command-and-control information, reducing dependence on centralized infrastructure. Its operators rapidly deployed new variants to evade antivirus signatures. The botnet also launched retaliatory DDoS attacks against systems probing infected computers for vulnerabilities or malware; these attacks could persist for more than a day and posed particular risks to publicly accessible university security scanners.
U.S. authorities linked Storm's operation to Russian cybercriminal Peter Yuryevich Levashov, also known as Peter Severa, and associated his botnets with harvesting personal information and login credentials from compromised computers. Storm declined during 2008 following researcher disruption and large-scale removal of infections by Microsoft's Malicious Software Removal Tool, and was reported effectively inactive by September 2008. It is distinct from the ransomware-as-a-service operation named Storm that emerged in 2026.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Storm repeatedly describes itself as the “first AI powered, quantum resistant ransomware.” Researchers found no conclusive evidence supporting AI use in intrusion, encryption, extortion, or affiliate support workflows.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
The Department of Justice said that Levashov “controlled and operated multiple botnets, including the Storm, Waledac, and Kelihos botnets to harvest personal information and means of identification (including email addresses, usernames and logins, and passwords) from infected computers.”
Its main brand is the notorious ‘Canadian Pharmacy’, which is all too familiar to everyone through massive email spam campaigns that seem never to end.
The members of SpamIt are allegedly the group behind the Storm, Waledec and potentially Conficker botnets, responsible for email distribution and fast-flux hosting of the spam websites
Levashov controlled and operated multiple botnets, including the Storm, Waledac and Kelihos botnets
The 38-year-old Russian’s botnet, which dated back to 2010, spanned more than 10,000 machines and was primarily used to send out spam, steal logins, distribute ransomware, and more.
Feed in a Google Refresh Token and a geographically matched SOCKS5 proxy, and the panel silently restores the victim's authenticated session.
to harvest personal information and means of identification (including email addresses, usernames and logins, and passwords) from infected computers
System information and screenshots are captured across multiple monitors.
Beyond credentials, Storm grabs documents from user directories, pulls session data from Telegram, Signal, and Discord, and targets crypto wallets through both browser extensions and desktop apps.
System information and screenshots are captured across multiple monitors.
Feed in a Google Refresh Token and a geographically matched SOCKS5 proxy, and the panel silently restores the victim's authenticated session.
Origins P2P networks are more scalable and robust than traditional C/S structures, and these advantages were recognized by the botnet authors early on and used in their botnets.
“For over two decades, Peter Levashov operated botnets which enabled him to harvest personal information from infected computers, disseminate spam, and distribute malware used to facilitate multiple scams,” said Assistant Attorney General Brian Benczkowski in a statement.
The members of SpamIt are allegedly the group behind the Storm, Waledec and potentially Conficker botnets, responsible for email distribution and fast-flux hosting of the spam websites
operators get a stealer that harvests browser credentials, session cookies, and crypto wallets, then quietly ships everything to the attacker's server for decryption.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.