Dark Storm Team sells DDoS attacks, database dumps and stolen account access via Telegram channels
Dark Storm Team, first observed in late 2023, runs a Telegram-based operation that mixes hacktivist messaging with paid cybercrime services: DDoS attacks sold by the hour or by the month, database dumps, compromised social-media accounts and surveillance access. A StealthMole investigation ties the sales and propaganda to a recurring owner persona, GLITCH, and shows the brand surviving repeated Telegram bans through backup channels and an allied group. The group's claim to have caused the March 2025 outages at X remains unconfirmed by X, and the supplied evidence does not establish GLITCH's real-world identity. The most concrete monetisation attempt was a $5,000 cryptocurrency extortion demand against the social platform Amino, but payment and impact are not confirmed. Criticity is medium: the operation is persistent and commercially active, yet its advertised offers and claims are not verified as capabilities or outcomes.
Detalhes técnicos
- Price list: The advertised DDoS packages were three hours for $20, eight hours for $50 and one month for $600. Social-media account access started at $250 and database dumps at $300, although earlier posts quoted dumps from $50. These figures describe advertised offers, not verified transactions.
- Wider catalogue: Later posts also offered payment-card data, CCTV access, paid channel placements and custom targeting.
- Targets: Campaign posts named government portals, financial institutions, transport organisations and major online platforms in several countries, usually paired with Check-Host availability reports. Those reports only show whether a probe could reach a site, so they do not prove DDoS causation, outage length or data compromise.
- Persona and attribution: GLITCH serves as owner, spokesperson and sales contact. A sales account kept Telegram user ID 8797265807 through username changes during 2026, which the investigation treats as stronger attribution evidence than display names. A rival group's identification of GLITCH was not corroborated.
- Ecosystem: Dark Storm repeatedly amplified NoName057(16) announcements. GLITCH's presence in a DDoSia-associated chat does not establish shared infrastructure, operational command or a formal alliance.
- X incident: The March 2025 disruption took place on March 10, 2025 (bleepingcomputer.com). Elon Musk called it a 'massive cyberattack' without specifically naming DDoS (bleepingcomputer.com), and X turned on Cloudflare DDoS protections (bleepingcomputer.com).
Linha do tempo
-
Dark Storm Team sells DDoS attacks, database dumps and stolen account access via Telegram channels
ler a análise desta fonte ocultar
Dark Storm Team, first observed in late 2023, runs a Telegram-based operation that mixes hacktivist messaging with paid cybercrime services: DDoS attacks sold by the hour or by the month, database dumps, compromised social-media accounts and surveillance access. A StealthMole investigation ties the sales and propaganda to a recurring owner persona, GLITCH, and shows the brand surviving repeated Telegram bans through backup channels and an allied group. The group's claim to have caused the March 2025 outages at X remains unconfirmed by X, and the supplied evidence does not establish GLITCH's real-world identity. The most concrete monetisation attempt was a $5,000 cryptocurrency extortion demand against the social platform Amino, but payment and impact are not confirmed. Criticity is medium: the operation is persistent and commercially active, yet its advertised offers and claims are not verified as capabilities or outcomes.
Technical Details
- Price list: The advertised DDoS packages were three hours for $20, eight hours for $50 and one month for $600. Social-media account access started at $250 and database dumps at $300, although earlier posts quoted dumps from $50. These figures describe advertised offers, not verified transactions.
- Wider catalogue: Later posts also offered payment-card data, CCTV access, paid channel placements and custom targeting.
- Targets: Campaign posts named government portals, financial institutions, transport organisations and major online platforms in several countries, usually paired with Check-Host availability reports. Those reports only show whether a probe could reach a site, so they do not prove DDoS causation, outage length or data compromise.
- Persona and attribution: GLITCH serves as owner, spokesperson and sales contact. A sales account kept Telegram user ID 8797265807 through username changes during 2026, which the investigation treats as stronger attribution evidence than display names. A rival group's identification of GLITCH was not corroborated.
- Ecosystem: Dark Storm repeatedly amplified NoName057(16) announcements. GLITCH's presence in a DDoSia-associated chat does not establish shared infrastructure, operational command or a formal alliance.
- X incident: The March 2025 disruption took place on March 10, 2025 (bleepingcomputer.com). Elon Musk called it a 'massive cyberattack' without specifically naming DDoS (bleepingcomputer.com), and X turned on Cloudflare DDoS protections (bleepingcomputer.com).