Storm has no published encryptor: no sample, file extension, ransom note name or note text has been released, so victims usually identify it from a leak-site post or a direct extortion contact rather than from locked files. It operates as a ransomware-as-a-service and data-extortion brand whose Tor leak site began listing victims in August 2026. It is separate from StormCry ( .stormous files), from the Stormous crew, and from StormEncryptor, the locker tied to the Storm-1175 actor. Most claimed victims are US mid-market firms in manufacturing, finance and healthcare, with smaller numbers in Canada, Australia, Germany and the UK. The site recruits affiliates, posts countdowns of two to three weeks, and says it avoids CIS targets. Some of its listings look duplicated or unverified, so the claim count may run high.
Decryptor: Decryptor availability has not been recorded. Checked 2026-10-28.
Data exfiltration risk: Likely — Storm lists victims on its Tor blog alongside descriptions of the stolen data, but no forensic report confirms how it was taken.
Do this first: Check the leak post and the contact channel against StormCry, Stormous and StormEncryptor markers before using any Storm-specific guidance.
Dealing with an active incident? Our incident response team is available 24/7.
Emergency response: +1 (877) 364-5161