STORM Ransomware Gang: 7 New Victims Posted in 72 Hours — Government, Healthcare & Financial Sector Alert

Classification: TLP:CLEAR | Published: 2026-08-25 | Source: STORM dark web leak site (.onion) via ransomware.live monitoring | Analyst: Security Arsenal Threat Intelligence

Executive Summary

Security Arsenal's dark web monitoring identified 7 new victim postings on the STORM ransomware group's .onion leak site between 2026-08-21 and 2026-08-23 — a compressed 72-hour publishing burst indicating either a coordinated intrusion wave or batch disclosure of previously compromised networks. The victim set skews heavily toward US-based small-to-midsize organizations in government, healthcare, financial services, and manufacturing, with one Australian outlier. Two victims (City of Mitchell, Pinnacle Hospital) represent high-impact public-sector and healthcare targets where operational disruption carries direct public-safety risk.

Defenders in the affected sectors should treat this as an active campaign window and immediately hunt for the pre-encryption staging indicators detailed in the Detection Engineering section below.

Threat Actor Profile — STORM

Analyst note: STORM's affiliate-based model means TTPs vary between intrusions, but the operator-controlled phases (negotiation, leak posting cadence, encryptor build) are consistent — which is what makes leak-site telemetry a reliable leading indicator.

Current Campaign Analysis

Victimology (2026-08-21 → 2026-08-23)

Sector Concentration

Manufacturing (2), Government (1), Transportation (1), Financial Services (1), Healthcare (1), Other (1). The blend is characteristic of opportunistic, access-driven targeting rather than sector-specific campaigns — affiliates hit whatever their initial access vector yields, and STORM posts everything.

Geographic Concentration

6 of 7 victims are US-based (86%). The single Australian victim (Sharp Motor Group) fits the pattern of affiliates purchasing access from brokers with indiscriminate geographic coverage.

Victim Profile

All named victims are small-to-midsize enterprises — regional banks, municipal governments, single-facility hospitals, and industrial subcontractors. Estimated revenue range: $10M–$250M annually. These organizations typically have:

• Lean security teams without 24/7 monitoring
• Flat network architectures with broad lateral reach once Domain Admin is achieved
• Legacy VPN/remote access infrastructure with delayed patch cycles
• Cyber-insurance-driven ransom payment calculus, making them attractive targets

Posting Frequency / Escalation

Seven postings in 72 hours is a compressed burst — 4 victims landed on a single day (2026-08-21). This pattern suggests either (a) a batch of intrusions from a shared initial access vector maturing simultaneously, or (b) an affiliate cashing out multiple access purchases at once. Watch for a second wave in the next 7–14 days.

CVE Correlation — Probable Initial Access Vectors

The timing and victim profile align with several CISA KEV entries with confirmed ransomware abuse:

• CVE-2026-50751 — Check Point Security Gateway improper authentication (IKEv1). Edge VPN exploitation is the most probable shared vector for this burst. Municipal governments and regional hospitals disproportionately run Check Point appliances, and improper-auth flaws yield direct unauthenticated network entry — no phishing required.
• CVE-2024-1708 — ConnectWise ScreenConnect path traversal → RCE. RMM abuse is a hallmark of mid-tier affiliates targeting SMBs, which are heavily managed by MSPs running ScreenConnect.
• CVE-2025-60710 — Windows link-following privilege escalation. Probable post-exploitation escalation primitive once initial access is achieved.
• CVE-2023-21529 — Exchange Server deserialization. Authenticated RCE on-prem Exchange; the regional bank and municipal victims are plausible on-prem Exchange shops.
• CVE-2026-48027 — Nx Console embedded malicious code. Supply-chain vector; relevant to manufacturing victims with development environments.

Priority action: If you run Check Point Security Gateway with IKEv1 enabled and have not patched CVE-2026-50751, assume you are in STORM's affiliate target pool.

Detection Engineering

Sigma Rules

---
title: STORM Ransomware - Volume Shadow Copy Deletion Pre-Encryption
id: 9a4b3c2e-storm-2026-0001
status: experimental
description: Detects vssadmin/wmic/bcdedit abuse consistent with STORM affiliate pre-encryption preparation (shadow copy deletion, recovery disable)
author: Security Arsenal Threat Intelligence
date: 2026/08/25
references:
  - https://securityarsenal.com/darkside
logsource:
  category: process_creation
  product: windows
  service: security
detection:
  selection_img:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
      - '\bcdedit.exe'
      - '\wbadmin.exe'
  selection_cmd:
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'recoveryenabled no'
      - 'delete catalog'
      - 'resize shadowstorage'
  condition: selection_img and selection_cmd
falsepositives:
  - Legitimate backup administration
level: high
tags:
  - attack.impact
  - attack.t1490
---
title: STORM Ransomware - PsExec or Rclone Staging for Lateral Movement and Exfil
id: 9a4b3c2e-storm-2026-0002
status: experimental
description: Detects PsExec-style remote service execution and Rclone execution with cloud exfiltration flags, both observed in STORM affiliate intrusions
author: Security Arsenal Threat Intelligence
date: 2026/08/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_psexec:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\paexec.exe'
      - '\remcom.exe'
  selection_rclone_img:
    Image|endswith:
      - '\rclone.exe'
  selection_rclone_cmd:
    CommandLine|contains:
      - 'copy'
      - 'sync'
      - 'move'
    CommandLine|contains:
      - 'mega:'
      - 's3:'
      - 'dropbox:'
      - 'gdrive:'
      - '--transfers'
  condition: selection_psexec or (selection_rclone_img and selection_rclone_cmd)
falsepositives:
  - Admin tooling in sanctioned deployments (baseline and allowlist by hash/path)
level: high
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.exfiltration
  - attack.t1567.002
---
title: STORM Ransomware - Post-Exploitation Windows Privilege Escalation via Link Following (CVE-2025-60710)
id: 9a4b3c2e-storm-2026-0003
status: experimental
description: Detects suspicious creation of junction points or symlinks by non-system processes in privileged directories, consistent with link-following privilege escalation used by ransomware operators
author: Security Arsenal Threat Intelligence
date: 2026/08/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mklink.exe'
  selection_cmd:
    CommandLine|contains:
      - 'mklink /j'
      - 'mklink /d'
      - 'New-Item -ItemType Junction'
      - 'New-Item -ItemType SymbolicLink'
  filter_paths:
    CommandLine|contains:
      - 'C:\Users\'
      - 'AppData\Local\Temp'
  condition: selection_img and selection_cmd and not filter_paths
falsepositives:
  - Software deployment scripts creating junctions in user-writable paths
level: medium
tags:
  - attack.privilege-escalation
  - attack.t1068

KQL — Microsoft Sentinel Hunt Query (Pre-Ransomware Staging)

// STORM Ransomware: hunt for lateral movement + staging indicators in last 14 days
// Looks for: new service installs on remote hosts (PsExec pattern), suspicious
// child processes of Remote Access tools (ScreenConnect), and Rclone execution.
let Lookback = 14d;
let SuspiciousServices = dynamic(["PSEXESVC", "PAExec", "RemCom", "rclone"]);
union
  (DeviceEvents
  | where Timestamp > ago(Lookback)
  | where ActionType == "ServiceInstalled"
  | extend ServiceName = tostring(parse_json(AdditionalFields).ServiceName)
  | where ServiceName has_any (SuspiciousServices)
  | project Timestamp, DeviceName, ServiceName, InitiatingProcessAccountName, InitiatingProcessCommandLine),
  (DeviceProcessEvents
  | where Timestamp > ago(Lookback)
  | where InitiatingProcessFileName has_any ("ScreenConnect.ClientService.exe", "ScreenConnect.Service.exe")
  | where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "rundll32.exe", "bitsadmin.exe", "certutil.exe")
  | project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName),
  (DeviceProcessEvents
  | where Timestamp > ago(Lookback)
  | where FileName =~ "rclone.exe" or ProcessCommandLine has_any ("rclone copy", "rclone sync", "rclone move")
  | project Timestamp, DeviceName, ProcessCommandLine, AccountName)
| sort by Timestamp desc

PowerShell — Rapid Response Script

# STORM Rapid Triage — run on suspected hosts or via remote sweep
# Checks: exposed RDP, scheduled tasks created in last 7 days, shadow copy status,
# and recent suspicious service installs (PsExec-style).

Write-Host "=== [1] RDP Exposure Check ===" -ForegroundColor Cyan
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections
Write-Host "RDP fDenyTSConnections = $rdpEnabled (0 = RDP ENABLED)"
Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue |
  Select-Object LocalAddress, LocalPort, State | Format-Table

Write-Host "=== [2] Scheduled Tasks Created in Last 7 Days ===" -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    if ($_.Date -and ([datetime]$_.Date) -gt $cutoff) {
        [PSCustomObject]@{ TaskName=$_.TaskName; Path=$_.TaskPath; Created=$_.Date; Author=$_.Author }
    }
} | Format-Table -AutoSize

Write-Host "=== [3] Volume Shadow Copy Status ===" -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) { Write-Host "WARNING: NO shadow copies present — possible vssadmin deletion (pre-encryption indicator)" -ForegroundColor Red }
else { $shadows | Select-Object DeviceObject, InstallDate, VolumeName | Format-Table }

Write-Host "=== [4] Suspicious Service Installs (Event 7045, last 14 days) ===" -ForegroundColor Cyan
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'PSEXESVC|PAExec|RemCom|rclone|ScreenConnect' } |
  Select-Object TimeCreated, Message | Format-List

Write-Host "=== [5] Recent Admin Share Writes (staging check) ===" -ForegroundColor Cyan
Get-ChildItem '\\localhost\ADMIN$' -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and $_.Extension -in '.exe','.bat','.ps1','.dll' } |
  Select-Object FullName, LastWriteTime | Format-Table

Incident Response Priorities

T-Minus Detection Checklist (Before Encryption Fires)

STORM affiliates typically detonate 4–14 days post-access. In order of signal strength:

1. Edge device anomalies — unauthenticated IKEv1 sessions on Check Point gateways; new local admin accounts on VPN appliances
2. RMM spawning shells — ScreenConnect or similar tools launching cmd/PowerShell outside change windows
3. Shadow copy deletion — vssadmin delete shadows is a near-certain pre-detonation indicator; alert at critical severity
4. Rclone/mass copy activity — large outbound transfers to Mega, S3, or Dropbox endpoints from servers
5. PsExec service installs across multiple hosts within a short window (encryptor push rehearsal)
6. New GPO modifications — affiliates stage encryption deployment via Group Policy
7. Backup system access attempts — Veeam/Commvault console logins from unexpected accounts

Critical Assets STORM Prioritizes for Exfiltration

Based on this victim set, expect targeting of:

• Government: citizen PII databases, utility billing records, police/court records
• Healthcare (Pinnacle Hospital): EHR exports, patient billing, PHI — maximum regulatory leverage
• Financial (The Cecilian Bank): customer account data, loan files, wire transfer records
• Manufacturing: CAD/design files, customer contracts, ERP exports (AutoDie/Schardein are supply-chain nodes — their data exposes their customers)
• File servers, NAS/SAN shares, and Exchange mailboxes are universal targets

Containment Actions — Ordered by Urgency

1. Isolate suspected hosts from the network immediately (EDR network isolation, not shutdown — preserve memory)
2. Block egress to consumer cloud storage (Mega, Dropbox, personal S3) at the proxy/firewall
3. Disable compromised accounts — especially any account used for cross-host service installs
4. Snapshot backups and take them offline/immutable NOW — before affiliates reach backup infrastructure
5. Patch or isolate Check Point gateways (CVE-2026-50751) — assume edge compromise if unpatched
6. Reset KRBTGT twice if Domain Admin compromise is confirmed
7. Preserve VPN/RMM/security appliance logs — edge device logs are your timeline backbone

Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateway for CVE-2026-50751 or disable IKEv1 if patching is not possible today
• Audit RDP exposure: no direct internet-facing RDP, period. Enforce VPN + MFA + NLA
• Update/connect ScreenConnect servers past CVE-2024-1708; audit for rogue client installs
• Deploy the Sigma rules above to your SIEM and set shadow-copy-deletion alerts to page on-call
• Block Rclone and unapproved sync tools via application control (WDAC/AppLocker)
• Verify backup immutability and confirm offline copies exist and restore-tested

Short-Term (2 Weeks)

• Segment the network — workstations-to-server lateral movement is how single-host compromise becomes enterprise encryption; enforce tiered admin and deny workstation-to-workstation SMB/RDP
• Deploy EDR with 24/7 monitoring (or engage an MDR) — STORM's SMB victimology is a direct function of unmonitored environments
• MFA everywhere remote — VPN, RMM, O365, backup consoles
• Exchange hardening/migration — on-prem Exchange (CVE-2023-21529 class) remains a favored authenticated RCE surface for ransomware crews
• Deception layer — canary files/credentials on file servers provide high-fidelity early warning during the staging phase
• Run a tabletop against a double-extortion scenario covering legal, comms, and cyber-insurance notification obligations

This briefing is derived from live dark web leak site telemetry collected 2026-08-25. Victim names reflect leak-site postings; posting does not confirm the full scope of compromise. Organizations named should be presumed breached and engaged through appropriate IR channels.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub