STORM Ransomware Gang: 4 New Victims Posted in 72 Hours — North American Manufacturing & Tech Targeting Analysis with Detection Rules

Classification: TLP:AMBER | Published: 2026-09-10 | Source: ransomware.live / STORM dark web leak site | Analyst: Security Arsenal Threat Intelligence

1. Threat Actor Profile — STORM

Aliases & Attribution: STORM operates under its own brand on a dedicated .onion leak site. Intelligence community overlap has been noted between STORM's operational tempo and tooling patterns consistent with mid-tier Ransomware-as-a-Service (RaaS) operations; no confirmed nation-state linkage at this time.

Operating Model: STORM is assessed to operate as a closed-group / semi-closed RaaS operation — a small core team handling negotiation and leak-site operations, with a limited affiliate roster executing intrusions. Victim volume (4 postings in the last 100 across a 72-hour burst) is consistent with a quality-over-volume affiliate model rather than spray-and-pray operations like LockBit or Akira at peak.

Ransom Demands: Mid-market demands typical of this tier range from $250K to $2.5M USD, scaled to victim revenue. Manufacturing victims — which dominate this burst — historically face demands in the $500K–$1.5M range given high operational downtime sensitivity.

Initial Access Methods (assessed TTP profile):

• VPN / edge appliance exploitation — perimeter device vulnerabilities are the group's most consistent entry vector (see CVE correlation in Section 2)
• Remote access tooling abuse — exploitation of legitimate remote management platforms (ConnectWise ScreenConnect patterns) for persistent access
• Phishing with macro-enabled attachments — secondary vector, typically targeting administrative/finance staff
• RDP exposure — brute-forced or credential-stuffed RDP on internet-facing hosts, followed by privilege escalation

Extortion Model: Classic double extortion — data theft precedes encryption, with leak-site publication used as pressure. The 72-hour clustered posting pattern suggests victims were breached days-to-weeks earlier and posted together after negotiation failures.

Dwell Time: Mid-tier RaaS operations of this profile typically exhibit 5–14 days of dwell time between initial access and detonation, with data staging occurring in the final 48–72 hours. This dwell window is the detection opportunity this briefing is built around.

2. Current Campaign Analysis

Victimology (last 100 leak-site postings)

Sector Targeting

• Manufacturing (50%) — dominant target. Consistent with ransomware economics: manufacturing orgs have extreme downtime sensitivity (production line stoppage = direct revenue loss), historically weaker OT/IT segmentation, and frequent flat networks. Flexmaster and Melitron both posted same-day, suggesting either a shared exploit window or batch negotiation collapse.
• Technology (25%) — technology firms are frequently targeted both for their own data and as pivot points into customer environments (supply-chain leverage).
• Retail & E-Commerce (25%) — typically targeted for PII/payment-adjacent data useful in extortion leverage.

Geographic Concentration

75% Canada / 25% US. This is a meaningful signal — most ransomware crews skew 60%+ US. A Canadian manufacturing concentration suggests either an affiliate with regional familiarity, targeting of a specific Canadian-managed VPN/RMM vendor footprint, or opportunistic exploitation of a sector-specific edge device prevalent in Canadian mid-market manufacturing.

Victim Profile

Based on sector mix, assessed victims are mid-market organizations (roughly 100–1,000 employees, $20M–$500M revenue) — large enough to pay meaningful ransoms, small enough to lack 24/7 SOC coverage. This is the classic sweet spot for closed-group RaaS operations.

Posting Frequency / Escalation

Three victims posted on a single day (2026-09-07) followed by one more 24 hours later indicates a batch publication event — the classic signature of simultaneous negotiation deadlines expiring. Expect follow-on postings within 7–14 days as the affiliate pipeline matures, or a quiet period if this burst exhausted the current intrusion inventory.

CVE Correlation — Probable Initial Access Vectors

The actively exploited CVEs associated with this campaign window map cleanly onto the assessed access methods:

• CVE-2026-50751 (Check Point Security Gateway — improper authentication in IKEv1 key exchange): Added to CISA KEV 2026-06-08. Perimeter VPN gateway auth bypass is the single most probable initial access vector for this burst. If you run Check Point gateways, this is your #1 priority.
• CVE-2024-1708 (ConnectWise ScreenConnect — path traversal → RCE): RMM abuse for persistence and lateral movement; a favorite of ransomware affiliates because ScreenConnect blends with legitimate admin traffic.
• CVE-2025-60710 (Windows link following → privilege escalation): Post-exploitation privesc, consistent with the escalation-to-domain-admin phase before staging.
• CVE-2023-21529 (Exchange deserialization): Authenticated RCE on Exchange — relevant for orgs with on-prem Exchange as a secondary entry or lateral pivot.
• CVE-2026-48027 (Nx Console embedded malicious code): Supply-chain flavored; watch developer workstations in technology-sector environments.

Assessment: The campaign chain is most likely Check Point VPN auth bypass → ScreenConnect/persistence deployment → Windows privesc → data staging → encryption + leak posting.

3. Detection Engineering

Sigma Rules

---
title: STORM Ransomware — VPN Edge Exploitation Followed by Suspicious Logon
description: Detects successful authentication shortly after anomalous or failed logon bursts against VPN/remote access infrastructure, consistent with Check Point IKEv1 auth bypass (CVE-2026-50751) or credential attacks against exposed RDP/VPN.
id: a1b2c3d4-storm-0001-4e5f-8a9b0c1d2e3f
status: experimental
date: 2026/09/10
author: Security Arsenal Threat Intelligence
references:
  - https://securityarsenal.com/darkside
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  category: authentication
  product: vpn
  service: remote_access
detection:
  selection_failed:
    EventType: authentication_failure
  selection_success:
    EventType: authentication_success
  selection_source:
    SourceIp|cidr:
      - '0.0.0.0/0'
  filter_known_ranges:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: (selection_failed and selection_success and selection_source) and not filter_known_ranges
timeframe: 15m
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1078
falsepositives:
  - Remote workers on dynamic residential IPs
---
title: STORM Ransomware — Lateral Movement via PsExec / WMI / Remote Service Creation
description: Detects remote service installation and WMI process execution consistent with ransomware affiliate lateral movement tooling (PsExec, WMIEXEC, Cobalt Strike psexec_psh) observed in pre-encryption staging.
id: a1b2c3d4-storm-0002-4e5f-8a9b0c1d2e3f
status: experimental
date: 2026/09/10
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  category: process_creation
detection:
  selection_psexec:
    Image|endswith:
      - '\PSEXESVC.exe'
      - '\psexec.exe'
      - '\paexec.exe'
      - '\remcomsvc.exe'
  selection_wmi_remote:
    ParentImage|endswith: '\WmiPrvSE.exe'
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\rundll32.exe'
  selection_service_install:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\Temp\\'
      - 'AppData\\Local\\Temp'
  condition: 1 of selection_*
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1047
  - attack.t1569.002
falsepositives:
  - Legitimate enterprise administration via SCCM/Intune — baseline and allowlist known management servers
---
title: STORM Ransomware — Pre-Encryption Staging and Shadow Copy Destruction
description: Detects data staging archive creation, mass file access patterns, and Volume Shadow Copy deletion commands that precede ransomware detonation in the final 48-72 hours of the intrusion lifecycle.
id: a1b2c3d4-storm-0003-4e5f-8a9b0c1d2e3f
status: experimental
date: 2026/09/10
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  category: process_creation
detection:
  selection_vss_delete:
    - CommandLine|contains:
        - 'vssadmin delete shadows'
        - 'vssadmin Delete Shadows'
        - 'wmic shadowcopy delete'
        - 'diskshadow'
    - CommandLine|contains|all:
        - 'bcdedit'
        - 'recoveryenabled'
        - 'no'
  selection_staging_archive:
    Image|endswith:
      - '\rar.exe'
      - '\7z.exe'
      - '\winrar.exe'
    CommandLine|contains:
      - ' a '
      - ' -p'
      - '.rar'
      - '.7z'
  selection_exfil_tooling:
    Image|endswith:
      - '\rclone.exe'
      - '\megacmd.exe'
      - '\FileZilla.exe'
    CommandLine|contains:
      - 'mega.io'
      - 'mega.nz'
      - 'dropmefiles'
      - 'temp.sh'
      - 'transfer.sh'
  condition: 1 of selection_*
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.exfiltration
  - attack.t1560.001
  - attack.t1567.002
falsepositives:
  - Backup administrators using vssadmin legitimately — correlate with service account context
  - Developers using 7zip — correlate with volume and destination

Microsoft Sentinel (KQL) — Lateral Movement & Pre-Ransomware Staging Hunt

// STORM Ransomware — Pre-detonation staging & lateral movement hunt
// Hunts for: remote service creation bursts, VSS tampering, archive staging,
// and RMM tooling (ScreenConnect/rclone) consistent with STORM playbook.
// Timeframe: last 14 days (aligned to assessed dwell time window)
let Lookback = 14d;
let SuspiciousHosts =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 7045  // Service installed
    | where ServiceFileName has_any ("ADMIN$", "\\Temp\\", "AppData\\Local\\Temp", "PSEXESVC")
    | summarize ServiceInstalls = count(), Services = make_set(ServiceName, 10) by Computer, bin(TimeGenerated, 1h)
    | where ServiceInstalls >= 3  // burst of service installs = lateral movement spray
    | project Computer, BurstWindow = TimeGenerated;
let ShadowTamper =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where Process has_any ("vssadmin", "wmic", "bcdedit", "diskshadow")
    | where CommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "resize shadowstorage")
    | project Computer, TimeGenerated, CommandLine, Account;
let Staging =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where Process has_any ("rar.exe", "7z.exe", "rclone.exe")
    | project Computer, TimeGenerated, Process, CommandLine, Account;
let RMM =
    DeviceProcessEvents
    | where TimeGenerated >= ago(Lookback)
    | where ProcessCommandLine has_any ("screenconnect", "rclone", "megacmd")
    | project Computer = DeviceName, TimeGenerated, Process = FileName, ProcessCommandLine;
union SuspiciousHosts, ShadowTamper, Staging, RMM
| summarize Indicators = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer
| where Indicators >= 2  // hosts with 2+ indicator classes = elevated priority
| sort by Indicators desc

Rapid Response PowerShell — Pre-Encryption Posture Check

# STORM Ransomware Rapid Response Script
# Run on suspect hosts or via remoting across the estate.
# Checks: exposed RDP, new scheduled tasks (7d), VSS state, suspicious services.

$report = [ordered]@{}

# 1. Is RDP enabled and reachable?
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue).fDenyTSConnections
$report['RDP_Enabled'] = if ($rdpEnabled -eq 0) { 'ENABLED - REVIEW EXPOSURE' } else { 'Disabled' }
$report['RDP_NLA'] = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue).UserAuthentication

# 2. Scheduled tasks created in last 7 days (ransomware persistence/detonation staging)
$cutoff = (Get-Date).AddDays(-7)
$report['NewScheduledTasks'] = Get-ScheduledTask | Where-Object {
    $_.Date -and ([datetime]$_.Date) -gt $cutoff -and $_.TaskPath -notlike '\Microsoft*'
} | Select-Object TaskName, TaskPath, Date, @{n='Action';e={$_.Actions.Execute}} | Format-List

# 3. Volume Shadow Copy state — STORM playbook deletes these pre-encryption
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
$report['ShadowCopyCount'] = ($shadows | Measure-Object).Count
$report['ShadowWarning'] = if (($shadows | Measure-Object).Count -eq 0) { 'NO SHADOW COPIES - POSSIBLE TAMPERING (T1490)' } else { 'OK' }

# 4. Recently created non-Microsoft services (PsExec-style persistence)
$report['RecentServices'] = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'Temp|AppData|ADMIN\$|PSEXESVC' -and $_.State -eq 'Running'
} | Select-Object Name, PathName, StartName | Format-List

# 5. RMM tooling presence check
$report['RMMTools'] = Get-ChildItem 'C:\Program Files','C:\Program Files (x86)','C:\Users\*\AppData' -Recurse -Depth 3 -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match 'ScreenConnect|rclone|megacmd|AnyDesk' } |
    Select-Object FullName, CreationTime | Format-List

$report | Format-List
Write-Host "`n=== STORM CHECK COMPLETE ===" -ForegroundColor Cyan
Write-Host "If ShadowWarning or suspicious services flagged: ISOLATE HOST NOW, preserve memory, escalate to IR." -ForegroundColor Red

4. Incident Response Priorities — STORM Playbook

T-Minus Detection Checklist (Before Encryption Fires)

Catch the intrusion during the 48–72 hour staging window:

• New VPN sessions from unfamiliar ASNs/geographies outside business hours, especially following Check Point gateway patch gaps (CVE-2026-50751)
• ScreenConnect or new RMM agents installed on servers where no deployment was scheduled
• Service creation bursts (EventID 7045) across multiple hosts within a 1-hour window
• Archive tool execution on file servers (rar/7z with password flags) — data staging signature
• rclone/megacmd network connections to consumer cloud storage endpoints
• vssadmin/bcdedit execution by non-backup accounts — final-stage indicator, encryption typically follows within hours
• Kerberos anomalies: golden-ticket-pattern TGT requests, DCSync-style replication requests from non-DC hosts

Exfiltration Priorities (What This Tier of Actor Steals)

• Manufacturing victims: CAD/engineering drawings, BOM data, supplier contracts, ERP exports
• Technology victims: source code repositories, customer databases, support ticket archives (contains credentials)
• All sectors: HR/payroll data (PII for extortion leverage), financial statements, executive email archives, cyber insurance policy documents (used to calibrate ransom demands — restrict access to insurance documentation)

Containment Actions (Ordered by Urgency)

1. Isolate at the edge first — disable compromised VPN accounts, force-reset all VPN/RMM credentials, apply Check Point CVE-2026-50751 remediation immediately
2. Kill RMM persistence — uninstall/block ScreenConnect and any unapproved remote access tooling via GPO/EDR network isolation
3. Credential hygiene sweep — reset domain admin, service accounts, and KRBTGT (twice) if lateral movement confirmed
4. Segment before shutdown — VLAN-isolate affected segments rather than powering off (preserve volatile evidence; ransomware detonation on shutdown is a known anti-IR trick)
5. Block exfil egress — deny-list consumer cloud storage domains at the proxy; alert on large outbound transfers (>5GB) to unsanctioned destinations
6. Protect backups — verify backup infrastructure is unreachable from the compromised segment; rotate backup service credentials

5. Hardening Recommendations

Immediate (24 hours)

• Patch Check Point Security Gateway (CVE-2026-50751) or disable IKEv1 where operationally feasible — this is the probable entry vector for the current burst
• Patch ConnectWise ScreenConnect (CVE-2024-1708) and audit for rogue ScreenConnect instances; consider application allow-listing against unauthorized RMM tools
• Apply Microsoft patches for CVE-2025-60710 and CVE-2023-21529 (Exchange on-prem especially)
• Enforce MFA on all VPN/remote access with no service-account exceptions
• Disable or restrict RDP from internet-facing interfaces; enforce NLA; move behind VPN/ZTNA
• Block macro execution from internet-sourced Office documents via GPO (Mark of the Web enforcement)

Short-Term (2 weeks)

• Deploy the Sigma rules above to your SIEM and tune against your admin tooling baseline
• Network segmentation: isolate manufacturing/OT-adjacent segments from corporate IT; manufacturing is the dominant target in this campaign and flat networks are why these intrusions succeed
• Egress filtering: default-deny outbound to unsanctioned cloud storage; TLS inspection on high-risk categories
• EDR coverage gap analysis: confirm servers (not just endpoints) have tamper-protected EDR — ransomware actors specifically hunt unmanaged servers for staging
• Backup architecture: implement immutable/air-gapped backups with credentials separated from domain identity; test a restore this quarter
• Deception: deploy canary files with telemetry on file servers — early warning that staging has begun
• Threat hunting cadence: run the KQL query above weekly at minimum; daily if you operate in Canadian manufacturing or US/CA technology sectors

Security Arsenal continues to monitor STORM's leak site for follow-on postings. Organizations matching the victim profile in this briefing — particularly Canadian manufacturing and US technology mid-market firms — should treat this as an elevated-threat window through at least 2026-09-24.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub