Storm — Ransomware Profile
Storm is an extortion operation that WatchGuard classifies as a data broker and ransomware-as-a-service outfit, first seen in August 2026. WatchGuard records 10 known victims and reports direct extortion and double extortion. The group runs a single Tor leak site and publishes a Tox identifier as its victim contact channel.IntelFusions coverage (2)
- Three banks on a leak site are one banking group 2026-09-20 · Ransomware
- New crew Storm goes after US clinics, banks and factories 2026-08-25 · Ransomware
Recent claimed victims
- TheraCare 2026-10-08
- Cooperative Des Techniciens Ambulanciers De La Monte 2026-10-08
- Nipigon District Memorial Hospital 2026-10-04
- Allied Machine & Engineering 2026-10-03
- Step By Step 2026-10-03
- States Industries 2026-10-03
- UC Components 2026-09-30
- Olnick Rentals 2026-09-30
- West County Health Centers 2026-09-30
- Agra Industries 2026-09-30
- Stockham Construction 2026-09-30
- Gardeners' Guild 2026-09-30
- Century Management Services 2026-09-30
- Silvercup Studios 2026-09-30
- Vintners Distributors 2026-09-30
- North Hills Facility Services 2026-09-30
- Poca Valley Bank 2026-09-30
- First Secure Bank Group 2026-09-27
- Applied Composites 2026-09-26
- Magna Legal Services 2026-09-26
- The Money Store 2026-09-21
- TrueCore Behavioral Solutions 2026-09-21
- Manroc Developments 2026-09-21
- American Casting Company 2026-09-18
- First Secure Community Bank 2026-09-18
Vendor research
- Storm Ransomware WatchGuard Technologies