STORM Ransomware Gang: 8 New Victims in 72 Hours — Energy, Financial & Healthcare Targeting Analysis with Detection Rules

Classification: TLP:CLEAR | Report Date: 2026-09-04 | Analyst: Security Arsenal Threat Intelligence | Source: Direct monitoring of STORM .onion leak site via ransomware.live

Executive Summary

STORM's dark web leak site shows a concentrated burst of victim postings between 2026-09-01 and 2026-09-02 — eight organizations disclosed in under 72 hours across three countries (CA, US, AU) and six sectors. The clustering of posting dates suggests either a single large intrusion wave (consistent with mass exploitation of a perimeter vulnerability) or a batch-and-release negotiation strategy where multiple victims who refused payment were published simultaneously. Either way, defenders in energy, financial services, healthcare, transportation, and agriculture should treat this as an active campaign indicator and initiate threat hunts immediately.

Threat Actor Profile — STORM

Current Campaign Analysis

Victimology (2026-09-01 → 2026-09-02)

Key observations:

• Financial services is the anchor sector — 3 of 8 victims (plus the duplicate/related "GSAC" posting, which may represent a parent entity of GSAC Auto Financing, suggesting data from a single intrusion leaked under two entries).
• Geographic concentration: 6 of 8 in the US, with Canada (energy) and Australia (financial) rounding out an English-speaking, Five Eyes target pattern typical of Western-focused RaaS affiliates operating under the informal "no CIS countries" rule.
• Victim profile: Small-to-mid-market enterprises (regional wealth advisors, auto financiers, specialty construction, regional aviation, medical device/clinical orgs). Estimated revenue band $10M–$500M — organizations large enough to pay, small enough to lack 24/7 SOC coverage. Classic ransomware sweet spot.
• Posting cadence: 8 posts in ~48 hours = batch release. This pattern historically indicates (a) a mass-exploitation event converting to intrusions in parallel, or (b) a negotiation deadline sweep. Watch for a second wave within 7–14 days if the underlying access vector remains unpatched across the victim pool.

Probable Initial Access Vector — CVE Correlation

Three CISA KEV entries with confirmed ransomware use align with this campaign window:

1. CVE-2026-50751 — Check Point Security Gateway (improper authentication, IKEv1). This is the prime suspect. Perimeter VPN gateway auth-bypass at scale produces exactly the multi-victim, multi-sector, multi-country pattern observed here. If you run Check Point gateways with IKEv1 enabled and have not patched since 2026-06-08, assume exposure.
2. CVE-2024-1708 — ConnectWise ScreenConnect path traversal / RCE. Widely abused by ransomware affiliates for initial access and persistence via legitimate RMM tooling. ScreenConnect also doubles as a lateral movement and payload-staging channel that blends with admin traffic.
3. CVE-2023-21529 — Microsoft Exchange deserialization and CVE-2025-60710 — Windows link-following privilege escalation fit the post-exploitation chain (mailbox access for phishing pivoting; local privesc during hands-on-keyboard).

CVE-2026-48027 (Nx Console embedded malicious code) is a developer-tooling supply-chain vector — lower confidence as a direct STORM vector, but flag any anomalous nx/vscode extension behavior in dev environments.

Detection Engineering

Sigma Rules

---
title: STORM Ransomware - Check Point VPN Auth Bypass Followed by Suspicious Logon (CVE-2026-50751)
id: 7a3e1c92-storm-2026-0001
status: experimental
description: Detects anomalous successful VPN authentication from unusual source IPs against Check Point gateways following exploitation of IKEv1 improper authentication, a suspected STORM initial access vector.
author: Security Arsenal Threat Intel
date: 2026/09/04
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
  product: checkpoint
  service: vpn
detection:
  selection_success:
    action: 'login'
    status: 'success'
  filter_baseline:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  filter_known_users:
    user|startswith:
      - 'svc_'
      - 'vpn_mfa_'
  condition: selection_success and not 1 of filter_*
fields:
  - src_ip
  - user
  - dest_ip
  - timestamp
falsepositives:
  - Traveling staff on residential ISPs (correlate with MFA logs and impossible travel)
level: high
tags:
  - attack.initial_access
  - attack.t1133
  - attack.t1190
---
title: STORM Ransomware - Pre-Encryption Staging and Shadow Copy Destruction
id: 7a3e1c92-storm-2026-0002
status: experimental
description: Detects Volume Shadow Copy deletion, backup catalog tampering, and boot configuration changes commonly executed by STORM affiliates minutes before ransomware detonation.
author: Security Arsenal Threat Intel
date: 2026/09/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    - Image|endswith: '\vssadmin.exe'
      CommandLine|contains:
        - 'delete shadows'
        - 'resize shadowstorage'
    - Image|endswith: '\wmic.exe'
      CommandLine|contains: 'shadowcopy delete'
    - Image|endswith: '\bcdedit.exe'
      CommandLine|contains:
        - 'recoveryenabled no'
        - 'ignoreallfailures'
    - Image|endswith: '\wbadmin.exe'
      CommandLine|contains: 'delete catalog'
  condition: selection_vss
fields:
  - CommandLine
  - ParentImage
  - User
  - Computer
falsepositives:
  - Legitimate backup maintenance windows (allowlist by service account and maintenance host)
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
---
title: STORM Ransomware - RMM Tool Execution and PsExec-Style Lateral Movement
id: 7a3e1c92-storm-2026-0003
status: experimental
description: Detects ScreenConnect/AnyDesk-style RMM execution from non-standard paths and PsExec-like remote service creation, consistent with STORM affiliate lateral movement and payload deployment.
author: Security Arsenal Threat Intel
date: 2026/09/04
logsource:
  category: process_creation
  product: windows
detection:
  selection_rmm_path:
    Image|contains:
      - '\AppData\Local\Temp\ScreenConnect'
      - '\ProgramData\screenconnect'
      - '\Users\Public\'
    Image|endswith:
      - 'screenconnect.clientservice.exe'
      - 'anydesk.exe'
      - 'psexec.exe'
      - 'psexesvc.exe'
  selection_remotesvc:
    EventID: 7045
    ServiceFileName|contains:
      - 'ADMIN$'
      - '\\Temp\\'
      - 'PSEXESVC'
  condition: 1 of selection_*
fields:
  - Image
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Managed IT/MSP tooling (baseline approved RMM hashes and service accounts; alert on all others)
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.t1219
  - attack.command_and_control

KQL (Microsoft Sentinel) — Pre-Detonation Staging & Lateral Movement Hunt

// STORM campaign hunt: mass remote execution + shadow copy tampering + staging archives
// Run over the last 14 days; investigate any host hitting 2+ clauses.
let Lookback = 14d;
let SuspiciousProcs = dynamic(["vssadmin.exe","wmic.exe","bcdedit.exe","wbadmin.exe","psexec.exe","psexesvc.exe","rclone.exe","7z.exe","winrar.exe","screenconnect.clientservice.exe"]);
let ProcHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where FileName in~ (SuspiciousProcs)
    | extend Indicator = case(
        FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows", "VSS_DELETE",
        FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled no", "BOOTCFG_TAMPER",
        FileName =~ "rclone.exe", "EXFIL_TOOL",
        FileName has "psexec", "LATERAL_PSEXEC",
        FileName has "screenconnect", "RMM_TOOL",
        FileName in~ ("7z.exe","winrar.exe") and ProcessCommandLine has_any ("a ","-p"), "ARCHIVE_STAGING",
        "OTHER")
    | where Indicator != "OTHER";
let NetHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemotePort in (445, 3389, 5985, 5986)
    | summarize SMBRDPConnections = dcount(RemoteIP), RemoteIPs = make_set(RemoteIP, 25)
        by DeviceName, InitiatingProcessFileName
    | where SMBRDPConnections >= 5;
ProcHits
| summarize Indicators = make_set(Indicator), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            CmdLines = make_set(ProcessCommandLine, 10), Accounts = make_set(AccountName)
    by DeviceName
| join kind=leftouter NetHits on DeviceName
| extend Score = array_length(Indicators) + iff(SMBRDPConnections >= 5, 1, 0)
| where Score >= 2
| order by Score desc, LastSeen desc
| project DeviceName, Indicators, Score, Accounts, FirstSeen, LastSeen, CmdLines, SMBRDPConnections, RemoteIPs;

PowerShell — Rapid Triage: Recent Persistence, VSS State, and Exposed RDP

# STORM Rapid Triage — run on suspected hosts or via remote sweep
# Checks: scheduled tasks (7d), suspicious services, VSS state, RDP exposure, recent archives
$ErrorActionPreference = 'SilentlyContinue'
$report = [ordered]@{}

# 1. Scheduled tasks created/modified in last 7 days
$report['RecentScheduledTasks'] = Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo
    [PSCustomObject]@{ TaskName = $_.TaskName; Path = $_.TaskPath;
        Author = $_.Author; LastRun = $info.LastRunTime;
        Action = ($_.Actions | ForEach-Object { $_.Execute + ' ' + $_.Arguments }) -join '; ' }
} | Where-Object { $_.Action -match 'AppData|ProgramData|Users\\Public|powershell.*-enc|certutil|bitsadmin' }

# 2. Non-Microsoft services with binary in writable/temp paths
$report['SuspiciousServices'] = Get-CimInstance Win32_Service | Where-Object {
    $_.PathName -match 'AppData|ProgramData|Users\\Public|\\Temp\\' -and
    $_.PathName -notmatch 'Microsoft|Windows'
} | Select-Object Name, DisplayName, State, StartName, PathName

# 3. Volume Shadow Copy status — empty list on a server = red flag
$report['ShadowCopies'] = Get-CimInstance Win32_ShadowCopy | Select-Object ID, InstallDate, VolumeName
$report['VssWritersFailed'] = (vssadmin list writers) | Select-String -Pattern 'State: \[(?!1\])' -Context 2,0

# 4. RDP exposure check
$rdpEnabled = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$rdpPort = (Get-ItemProperty 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
$report['RDP'] = [PSCustomObject]@{ Enabled = $rdpEnabled; Port = $rdpPort;
    FirewallOpen = [bool](Get-NetFirewallRule -DisplayGroup 'Remote Desktop' | Where-Object Enabled -eq 'True') }

# 5. Large archives created in last 7 days (staging indicator)
$report['RecentLargeArchives'] = Get-ChildItem -Path 'C:\Users','C:\ProgramData' -Recurse -Depth 3 \
    -Include *.zip,*.7z,*.rar | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) -and $_.Length -gt 100MB } |
    Select-Object FullName, Length, LastWriteTime

$report | ConvertTo-Json -Depth 4 | Out-File "$env:TEMP\storm_triage_$(hostname)_$(Get-Date -Format yyyyMMdd_HHmm).json"
Write-Output "[+] Triage complete. Review JSON in $env:TEMP"

Incident Response Priorities (STORM Playbook)

T-Minus Detection Checklist — Before Encryption Fires

1. VPN/edge logs: Successful Check Point authentications from unfamiliar ASNs or residential IPs, especially service accounts never used remotely (CVE-2026-50751 window is open — unpached gateways are being actively scanned).
2. New RMM tooling: ScreenConnect, AnyDesk, or Atera appearing on hosts where they were never deployed. Affiliates use RMM for persistence and staging.
3. Mass SMB/RDP fan-out: One workstation initiating admin-share or RDP connections to 5+ hosts within an hour.
4. Archive staging: Large .7z/.zip/.rar files appearing in ProgramData, user profiles, or file shares; rclone.exe, WinSCP, or MEGA/GoFile/DropMeFiles egress in proxy logs.
5. Shadow copy enumeration/deletion: vssadmin list shadows followed by deletion — encryption is typically minutes away at this point.

Data This Actor Profile Prioritizes for Exfiltration

• Financial records (loan books, client portfolios — highly relevant to the GSAC, Chicago Partners, Macquarrie victims)
• PII/PHI (healthcare and financial victims: SITES Medical patient data, advisory client PII)
• Legal/contracts and M&A documents
• Email archives of executives (used to pressure negotiations)
• Backup configurations and credentials (to destroy recovery options)

Containment — Ordered by Urgency

1. Isolate at the edge: Block C2 and RMM domains/IPs at the firewall; disable compromised VPN accounts; force credential resets for all VPN-authenticated users.
2. Kill RMM persistence: Remove unauthorized ScreenConnect/AnyDesk agents enterprise-wide; hunt for their service names (ScreenConnect ClientService, random 8-char service names).
3. Segment: Disable SMBv1, restrict workstation-to-workstation 445/3389 via host firewall, isolate backup infrastructure immediately.
4. Protect backups: Take backups offline/immutable; verify shadow copies and backup catalogs haven't been tampered with.
5. Preserve forensics: Capture memory on patient-zero hosts before reboot; export VPN, EDR, and DC logs (EventIDs 4624/4625/7045/4663) to a SIEM before rotation.
6. Engage IR retainer before negotiating — batch-leak actors often publish regardless of payment.

Hardening Recommendations

Immediate (24 Hours)

• Patch Check Point Security Gateway (CVE-2026-50751) or disable IKEv1 VPN tunnels. If patching is impossible this week, restrict VPN access to known source IP ranges and enforce MFA on every account.
• Patch/audit ConnectWise ScreenConnect (CVE-2024-1708) — verify no rogue extensions/plugins and no unexpected admin accounts. If ScreenConnect isn't business-critical, remove it.
• Block unauthorized RMM: Application-control policy (WDAC/AppLocker) allowing only your approved RMM binary hash; alert on all other remote-access tool execution.
• Deploy the Sigma rules and KQL hunt above; run the PowerShell triage on any host that handled VPN authentication in the past 30 days.
• Verify backups: Confirm offline/immutable copies exist and test one restore today. Audit vssadmin, wbadmin, and bcdedit execution alerts.

Short-Term (2 Weeks)

• Patch Exchange (CVE-2023-21529) and Windows link-following privesc (CVE-2025-60710) across the estate; these are standard links in the post-exploitation chain.
• Move VPN behind identity-aware access: Replace legacy IKEv1/IPSec remote access with ZTNA or, at minimum, certificate + MFA-only authentication with impossible-travel detection.
• Egress filtering: Deny outbound to known exfil destinations (rclone endpoints, GoFile, Mega, DropMeFiles, Temp-Mail domains); alert on >5GB outbound from any single endpoint in 24h.
• Tiered admin model: No DA credentials on workstations; LAPS on all endpoints; gMSA for service accounts; block pass-the-hash via Credential Guard.
• Deception: Deploy canary file-shares and honey credentials — ransomware affiliates trip these during enumeration with near-zero false positives.

This briefing is based on live monitoring of STORM's .onion leak site. Victim listings indicate claimed compromise; inclusion does not confirm the scope of data theft. Organizations named should be considered at elevated risk of follow-on extortion and data publication.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub