Stormous

Stormous is a cybercriminal extortion and ransomware-branded threat group active since 2021. The group has presented itself as Arabic-speaking and has been assessed as likely originating from North Africa. It became widely known for leak-site activity, website defacement, information theft, and data-leak extortion, and has at times claimed ransomware capability. Reporting has repeatedly noted uncertainty around the consistency of its encryption operations, with some assessments indicating that Stormous has often functioned as a leak-site and stolen-data extortion actor and may in some cases have republished victim information obtained from other criminal groups. A PHP-based malware family associated with Stormous has been described as combining backdoor and ransomware functionality, enabling remote access, payload delivery, file encryption, and ransom-note deployment, particularly against PHP-enabled web servers and vulnerable web applications. Stormous publicly aligned itself with Russia during the early phase of the Russia-Ukraine war and declared intent to target Ukrainian government institutions, giving the group a notable hacktivist and geopolitical dimension alongside its criminal activity. Over time, however, its observed operations have centered primarily on financially motivated victimization and public extortion through leak infrastructure. Stormous has been repeatedly discussed alongside other extortion-focused groups such as Karakurt, RansomHouse, and Snatch in analyses of repeat victimization and possible inter-group cooperation or coexistence within the leak-site ecosystem. Victim reporting links Stormous to attacks and extortion claims against organizations in North America, Europe, Asia, Africa, and Latin America. Observed targets include government and public-sector entities, manufacturing and industrial organizations, consumer-facing businesses, retail-related organizations, pharmaceutical and health-related firms, educational or religious institutions, and business services. In 2026, Stormous showed increased visibility in industrial and manufacturing-related victim claims across multiple regions. Operationally, Stormous has been associated with initial access against exposed web infrastructure, data theft, persistence through backdoor access, post-compromise payload deployment, and public shaming via leak-site publication. High-confidence reporting supports capabilities including initial access, exfiltration, persistence, post-exploitation, and extortion-oriented leak operations. The group should be understood as a ransomware-branded extortion actor whose tradecraft spans both data-theft-only coercion and claimed encryption activity, with a history of politically aligned messaging but predominantly criminal outcomes.