Signalis
sign in--:--:--UTC
Threat actors

Storm

☆ pin
Reports
87
First seen
Aug 7, 2026
Last seen
Oct 16, 2026
Motivation
Financial

Targeting

Sectors
Manufacturing ×24Healthcare ×16Financial Services ×16Professional Services ×10Retail & E-commerce ×5Agriculture ×3Technology ×3Defense ×2
Victim regions
×1
×63
United States×63
Canada×9
Australia×5
Germany×3
United Kingdom×1
India×1
France×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Indicators

domain ×161ip_v4 ×78hash_md5 ×10hash_sha256 ×8hash_sha1 ×3bitcoin_address ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Storm ransomware gang publishes R. A. Wood Associates as victim

ransomware.liveHigh

Storm ransomware gang claims Tech Electronics as victim

ransomware.liveHigh

Storm ransomware claims Tech Electronics victim

ransomware.liveHigh

Storm ransomware gang claims victim: Cooperative Des Techniciens Ambulanciers De La Monte

ransomware.liveHigh

Storm ransomware gang publishes TheraCare as victim

ransomware.liveHigh

Storm ransomware gang publishes Nipigon District Memorial Hospital as victim

ransomware.liveHigh

Storm ransomware group claims States Industries as victim

ransomware.liveHigh

Storm ransomware gang claims Allied Machine & Engineering as new victim

ransomware.liveHigh

Storm ransomware gang publishes Step By Step, Inc. as victim

ransomware.liveHigh

Storm ransomware gang publishes West County Health Centers as victim

ransomware.liveHigh

Storm ransomware gang publishes Gardeners' Guild as victim

ransomware.liveHigh

Storm ransomware claims North Hills Facility Services victim

ransomware.liveHigh

Storm ransomware gang claims Olnick Rentals breach

ransomware.liveHigh

Storm ransomware claims Century Management Services as new victim

ransomware.liveHigh

Storm ransomware gang claims Silvercup Studios breach

ransomware.liveHigh

Storm ransomware gang publishes UC Components as victim

ransomware.liveHigh

Storm ransomware gang publishes Stockham Construction as victim

ransomware.liveHigh

Storm ransomware claims Vintners Distributors victim

ransomware.liveHigh

Storm ransomware claims Agra Industries victim

ransomware.liveHigh

Storm ransomware claims Poca Valley Bank

ransomware.liveHigh

Storm ransomware gang publishes First Secure Bank Group as victim

ransomware.liveHigh

Storm ransomware gang claims Applied Composites breach

ransomware.liveHigh

Storm ransomware gang publishes Magna Legal Services as victim

ransomware.liveHigh

Storm ransomware claims The Money Store as victim

ransomware.liveHigh

Storm ransomware gang publishes TrueCore Behavioral Solutions as victim

ransomware.liveHigh

Storm ransomware gang publishes Manroc Developments as victim

ransomware.liveHigh

Storm ransomware gang claims American Casting Company victim

ransomware.liveHigh

Storm ransomware publishes Johnson Investment Counsel as victim

ransomware.liveHigh

Storm ransomware gang publishes First Secure Community Bank as victim

ransomware.liveHigh

Storm ransomware gang publishes State Bank Group as victim

ransomware.live

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.

Sign upSee plans