Hunt / storm
Storm
Not Microsoft's Storm-#### naming.
83victims, 90d
Oct 19last post
0reports about them
-techniques with a rule
0indicators
Nothing published that we can read says how Storm gets in or what it runs once inside. This page is who they hit, and that is all we have. If you know of a public write-up, it belongs here.
Who they hit
| Posted | Victim | Country |
|---|---|---|
| 2026-10-19 | Baltimore Tank Lines | US |
| 2026-10-19 | Merit Financial Group | US |
| 2026-10-19 | Patriot Maritime | US |
| 2026-10-16 | R. A. Wood Associates | US |
| 2026-10-16 | Tech Electronics | US |
| 2026-10-08 | Cooperative Des Techniciens Ambulanciers De La Monte | CA |
| 2026-10-08 | TheraCare | US |
| 2026-10-04 | Nipigon District Memorial Hospital | CA |
| 2026-10-04 | Nipigon District Memorial Hospital | CA |
| 2026-10-03 | States Industries | US |
| 2026-10-03 | States Industries | US |
| 2026-10-03 | Allied Machine & Engineering | US |
Latest 12 of 83, from ransomware.live. These are the group's claims.
Confirmed elsewhere
Victims of Storm that a second, independent source also named inside two weeks. How convergence works.
- 2026-11-07 Insight Credit Union leak + notice + press
- 2026-09-17 WindRose Health Network leak + notice
Sweep
No indicators. Either nobody has published any for Storm, or the reports cite values without marking them as IOCs. package.json