Storm Ransomware: A New Group Hitting US Firms Fast

Storm's leak site was first seen on 7 August 2026. By 1 October it had listed 78 victims, 37 of them in the previous 30 days, which made it the third most active group in that period (ransomware.live). 60 of the 78 are in the United States, followed by Canada and Australia. Manufacturing and financial services are hit most, then healthcare.

The name causes confusion. Microsoft uses "Storm-" followed by a number for threat clusters it has not yet attributed, and those have nothing to do with this group. This post is about the operation that runs the leak site under the name Storm.

No detailed technical analysis of Storm's encryptor has been published, so its encryption method, file extension, ransom note and usual way in are not publicly confirmed. Tracking sites list it as a ransomware-as-a-service operation, meaning different affiliates carry out the attacks, and it publishes victims who do not pay. That is the extent of what can be said reliably today. We will update this page as analysis appears.

Not knowing the family does not change the first steps. Isolate affected machines from the network but leave them powered on, because memory can hold evidence and sometimes key material. Keep a copy of the ransom note and a few encrypted files. Do not rebuild, reinstall or run "decryptor" tools found online.

Recovery then comes from what the attack did not reach or did not finish: backup repositories that were offline or unreachable, storage snapshots, and large files such as databases and virtual disks that were only partly processed. That is checked file by file on an image of the affected storage, never on the original.