Stormous Ransomware Group: CVEs, Techniques and Tools

Overview

Stormous is an Arabic-speaking, pro-Russian ransomware and hacktivist group active since at least 2022, known for politically motivated attacks across 15+ countries, collaborating with GhostSec on the GhostLocker 2.0 RaaS platform and inheriting GhostSec's RaaS operations in mid-2024. On 1st July 2026 the group has annonced the end of their operations & ervices

First tracked: 2022-03-22
Discussed in our reports: Maghreb · UAE

What public reporting says

Describes itself as an Arabic-speaking, pro-Russian group, with ransom notes in Arabic, active since at least 2022. The security community is sceptical of its self-description, so we map no origin country.

LevelBlue SpiderLabs

Geography: origin and targets

No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.

United States of America14
Spain11
United Arab Emirates10
France10
United Kingdom7
Brazil7
Italy6
Germany6
Indonesia6
Vietnam5

Exploited vulnerabilities

None recorded in the sources we reviewed.

ATT&CK techniques

Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact	Resource Development	Reconnaissance
Valid Accounts	Command and Scripting Interpreter	Scheduled Task/Job	Abuse Elevation Control Mechanism: Bypass UAC	Obfuscated Files or Information	OS Credential Dumping	Network Service Discovery	Remote Services: Remote Desktop Protocol	Data from Local System	Exfiltration Over C2 Channel	Application Layer Protocol: Web Protocols	Data Encrypted for Impact	Obtain Capabilities: Tool	Active Scanning
Exploit Public-Facing Application	Command and Scripting Interpreter: Visual Basic	Account Manipulation		Obfuscated Files or Information: Software Packing		File and Directory Discovery	Remote Services: SMB/Windows Admin Shares	Archive Collected Data	Exfiltration Over Web Service: Exfiltration to Cloud Storage		Inhibit System Recovery
Trusted Relationship	User Execution: Malicious File	Server Software Component: Web Shell		Obfuscated Files or Information: Fileless Storage
Phishing		Create or Modify System Process: Windows Service		Obfuscated Files or Information: Encrypted/Encoded File
Phishing: Spearphishing Attachment		Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder		Indicator Removal
				Impair Defenses: Disable or Modify Tools

Technique details

Tools

None recorded in the sources we reviewed.

Leak-site infrastructure

Title	Type	Address (defanged)	Seen online at snapshot
Database Shop	DLS	`3slz4povugieoi3tw7sblxoowxhbzxeju427cffsst5fo2tizepwatid[.]onion`	No
Stormous.Leak	DLS	`pdcizqzjitsgfcgqeyhuee5u6uki6zy5slzioinlhx6xjnsw25irdgqd[.]onion`	No
StormouS.X BLOG \| Official blog	DLS	`stmxylixiz4atpmkspvhkym4xccjvpcv3v67uh3dze7xwwhtnz4faxid[.]onion`	No
Stormous _ official Site	DLS	`h3reihqb2y7woqdary2g3bmk3apgtxuyhx4j2ftovbhe3l5svev7bdyd[.]onion`	No

Sources and caveats

Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.

Data snapshot: 2026-10-11