Stormous

☆ pin

Reports

First seen

Nov 1, 2025

Last seen

Jul 1, 2026

Motivation

Financial

Targeting

Sectors

Retail & E-commerce ×7 Other ×6 Government ×3 Technology ×1 Financial Services ×1 Education ×1

Victim regions

×1

×3

Malaysia×3

United Kingdom×2

Netherlands×2

Australia×2

Italy×2

Japan×1

Tunisia×1

United States×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1190 Exploit Public-Facing Application ×2T1005 Data from Local System ×2T1505.003 Web Shell ×1T1566.002 Phishing: Spearphishing Link ×1T1070.001 Indicator Removal: Clear Windows Event Logs ×1T1486 Data Encrypted for Impact ×1T1547 Boot or Logon Autostart Execution ×1T1566 Phishing ×1T1598 Phishing for Information ×1T1489 Service Stop ×1

Indicators

domain ×39cve ×3hash_sha1 ×1ip_v4 ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2021-26829 (exploited)CVE-2025-27915 (exploited)CVE-2025-41244 (exploited)

Recent reports

High

Stormous

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Stormous claims new victim: Higuchi Inc

Stormous claims new victim: maglificioliliana.com with full data dump

Stormous publishes new victim: lorenzoni-store.com with data dump

Stormous publishes montechiaro-store.com as ransomware victim

Stormous ransomware gang publishes impulso-store.com victim data

Stormous publishes Higuchi Inc. as ransomware victim

Stormous ransomware gang publishes HIGUCHI USA, INC as victim

Stormous publishes eogb.co.uk victim on ransomware.live

Stormous publishes eshacloudqa.com as new victim

Stormous claims Monoprix.tn ransomware victim

Stormous claims access to Palatine School infrastructure, offers free security audit

Stormous publishes mlit.com.my as new victim with full data dump

Stormous publishes jaggroup.com as ransomware victim

Stormous ransomware gang publishes new victim

Stormous ransomware gang publishes Lorenzoni Store as victim

Stormous claims new victim: montechiaro-store.com

Stormous ransomware gang publishes impulso-store.com as victim

Stormous publishes jaggroup.com as ransomware victim with full data dump

Stormous ransomware gang publishes victim mlit.com.my with 10GB data dump

Stormous publishes MLIT breach: Malaysia government IT ministry compromised

Stormous claims new victim: katholiekamersfoort.nl

Stormous ransomware gang publishes sa2000.com victim data

Stormous claims victim SA2000.COM on ransomware.live

Stormous ransomware gang publishes katholiekamersfoort.nl as victim

Stormous ransomware gang claims breach of VSP Solutions Australia

Stormous ransomware gang claims breach of TTT Company (ttt.vn); 5TB data exfiltrated

Stormous ransomware gang claims VSP Solutions Australia victim

Stormous ransomware gang publishes ARC Reins and Fidelity United data breach

Cyber Brief October 2025 – Espionage, Disruption, Data Breaches, and Supply Chain Threats