Stormous
Attribution profile
- Type
- Criminal
- Location
- Russia
- Known incidents
- 6 incidents
- Sources
- 4 sources
- First seen
- 2022-04-26
- Last seen
- 2026-06-09
- Updated
- 2026-10-14 16:10
- Aliases
- 1 alias
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Stormous, also known as Stormous, is a pro‑Russian ransomware/data extortion group that operates from Russia. The actor has targeted educational institutions, energy‑sector firms, universities, multinational corporations and religious organizations across Europe and North America, seeking financial gain through the sale of stolen data while expressing an anti‑Western stance. Its typical tactics involve claiming breaches via Telegram, publishing proof such as invoices, plans or tax identification numbers on a leak site, and offering the exfiltrated data for sale; the group has stated it exploits weak passwords and does not deploy file‑encrypting malware, functioning more as a data‑theft extortion operation. While Stormous frames its actions as supportive of Russia and has framed its activities as a response to perceived attacks on Russia, no public evidence links it to a state sponsor or a formal criminal consortium. Notable operations include the alleged 2022 breach of Coca‑Cola, where 161 GB of data was offered for roughly $64 000 in Bitcoin, the claimed 2022 attack on the University of Rome Tor Vergata that cited weak passwords and offered data for $2 000, the 2023 leak of half the stolen data from the Instituto De Educación Secundaria Ies Emilio Canalejo Olmeda in Spain, and the 2023 extortion of the energy‑efficiency firm Zurcal, which saw invoices, plans and a tax ID posted on the group’s Telegram channel.
Incidents
Attributed incidents are available to members.
6 incidentsSources
Sources available to members: 4 sources.