Storm RaaS emerges with 50+ victims in six weeks, marketing unverified 'AI-powered, quantum-resistant' ransomware
A new ransomware-as-a-service operation, Storm, appeared in August 2026 and claimed more than 50 victims in about six weeks across North America, Europe and Oceania. It targets healthcare, finance, manufacturing, business services, government, transportation and critical infrastructure. The group promotes itself as the "first AI powered, quantum resistant ransomware", but Check Point Exposure Management found no evidence of AI in its deployment, targeting, encryption or extortion. The AI claim appears to be a recruitment and branding tactic. Storm offers affiliates up to 90% of revenue and runs an unusually polished Tor leak site.
Detalhes técnicos
- Affiliate model: tiered revenue share of 75%, rising to 80%, and reaching 90% for revenue above $750,000. Storm also openly solicits Initial Access Brokers, data brokers and network access providers.
- Service catalog: lockers for Windows, Linux, ESXi and NAS, victim chat management, call center services, AV/EDR bypass support, DDoS capabilities and media outreach.
- Launch: the Initial Access Broker BigBro advertised the operation on a darknet forum before the first victim was published. Storm then posted its own pinned recruitment post.
- Leak site: Tor-based, with an interactive global victim map, sector filters, search, victim timelines, document tree previews and a custom graphical CAPTCHA.
- Victimology: observed victims are in the United States, Germany, Canada and Australia. Business services account for 13 incidents, finance 9, manufacturing 7, and retail and healthcare 6 each. Healthcare victims include hospitals, health networks, treatment providers, radiology organizations and hospice services. Researchers assess this concentration as deliberate targeting of organizations under pressure to pay.
- AI claims: unverified. Any references to automated victim management and negotiation may signal workflow automation, not AI-enhanced offensive capability.
Remediação
The article gives no specific mitigations. It only mentions Check Point Exposure Management as a product for monitoring ransomware groups and emerging actor activity on the dark web, without presenting it as a recommendation.
Linha do tempo
-
Storm RaaS emerges with 50+ victims in six weeks, marketing unverified 'AI-powered, quantum-resistant' ransomware
ler a análise desta fonte ocultar
A new ransomware-as-a-service operation, Storm, appeared in August 2026 and claimed more than 50 victims in about six weeks across North America, Europe and Oceania. It targets healthcare, finance, manufacturing, business services, government, transportation and critical infrastructure. The group promotes itself as the "first AI powered, quantum resistant ransomware", but Check Point Exposure Management found no evidence of AI in its deployment, targeting, encryption or extortion. The AI claim appears to be a recruitment and branding tactic. Storm offers affiliates up to 90% of revenue and runs an unusually polished Tor leak site.
Technical Details
- Affiliate model: tiered revenue share of 75%, rising to 80%, and reaching 90% for revenue above $750,000. Storm also openly solicits Initial Access Brokers, data brokers and network access providers.
- Service catalog: lockers for Windows, Linux, ESXi and NAS, victim chat management, call center services, AV/EDR bypass support, DDoS capabilities and media outreach.
- Launch: the Initial Access Broker BigBro advertised the operation on a darknet forum before the first victim was published. Storm then posted its own pinned recruitment post.
- Leak site: Tor-based, with an interactive global victim map, sector filters, search, victim timelines, document tree previews and a custom graphical CAPTCHA.
- Victimology: observed victims are in the United States, Germany, Canada and Australia. Business services account for 13 incidents, finance 9, manufacturing 7, and retail and healthcare 6 each. Healthcare victims include hospitals, health networks, treatment providers, radiology organizations and hospice services. Researchers assess this concentration as deliberate targeting of organizations under pressure to pay.
- AI claims: unverified. Any references to automated victim management and negotiation may signal workflow automation, not AI-enhanced offensive capability.
Remediation
The article gives no specific mitigations. It only mentions Check Point Exposure Management as a product for monitoring ransomware groups and emerging actor activity on the dark web, without presenting it as a recommendation.