STORM Ransomware Gang: 8 Victims Posted in 4 Days — US Financial Services Blitz, Detection Rules & IR Playbook

---
title: STORM Ransomware - VPN/Perimeter Exploitation Followed by Suspicious Logon
id: 9a1f3c2e-7b44-4d21-9f0a-storm00001a
status: experimental
description: Detects successful remote logons from unusual source IPs within 24h of VPN gateway authentication anomalies, consistent with STORM's perimeter-first access via Check Point/Cisco VPN exploitation (CVE-2026-50751, CVE-2026-20316)
author: Security Arsenal Threat Intelligence
date: 2026/09/18
references:
    - https://securityarsenal.com/darkside
logsource:
    product: windows
    service: security
    category: logon
detection:
    selection_type:
        EventID: 4624
        LogonType:
            - 3
            - 10
    selection_ip:
        IpAddress|startswith:
            - '10.'
            - '192.168.'
            - '172.16.'
    filter_internal:
        IpAddress|startswith:
            - '10.'
            - '192.168.'
            - '172.16.'
    condition: selection_type and not filter_internal
falsepositives:
    - Legitimate VPN users from residential ISPs (baseline known VPN egress ranges and tune)
    - Contractors and MSP access (whitelist known MSP CIDRs — but audit them, given ScreenConnect risk)
level: high
tags:
    - attack.initial_access
    - attack.t1133
    - attack.t1078
---
title: STORM Ransomware - Lateral Movement via PsExec or WMI with Cobalt Strike-Style Named Pipes
id: 9a1f3c2e-7b44-4d21-9f0a-storm00002b
status: experimental
description: Detects PsExec service execution and WMI remote process creation combined with known Cobalt Strike default named pipe patterns observed in pre-encryption lateral movement phases
date: 2026/09/18
author: Security Arsenal Threat Intelligence
logsource:
    category: pipe_created
    product: windows
detection:
    selection_pipes:
        PipeName|contains:
            - '\PSEXESVC'
            - '\MSSE-'
            - '\status_'
            - '\msagent_'
            - '\postex_'
            - '\spoolss_'   # observed CS custom profile artifacts
    condition: selection_pipes
falsepositives:
    - Legitimate PsExec administrative use (correlate with service install EventID 7045 and source account)
level: critical
tags:
    - attack.lateral_movement
    - attack.t1021.002
    - attack.t1569.002
    - attack.s0029
---
title: STORM Ransomware - Pre-Encryption Staging and Shadow Copy Destruction
id: 9a1f3c2e-7b44-4d21-9f0a-storm00003c
status: experimental
description: Detects data staging via archive utilities to temp directories followed by Volume Shadow Copy deletion and backup catalog tampering - the canonical T-minus indicators before STORM detonation
author: Security Arsenal Threat Intelligence
date: 2026/09/18
logsource:
    category: process_creation
    product: windows
detection:
    selection_staging:
        Image|endswith:
            - '\rclone.exe'
            - '\7z.exe'
            - '\rar.exe'
            - '\winrar.exe'
        CommandLine|contains:
            - '\AppData\Local\Temp'
            - '\ProgramData'
            - 'copy'
            - 'sync'
    selection_vss:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
            - '\bcdedit.exe'
            - '\wbadmin.exe'
        CommandLine|contains:
            - 'delete shadows'
            - 'shadowcopy delete'
            - 'resize shadowstorage'
            - 'delete catalog'
            - 'recoveryenabled no'
    timeframe: 30m
    condition: selection_staging or selection_vss
falsepositives:
    - Legitimate backup maintenance windows (suppress via approved change ticket integration)
    - System administrators using 7z for packaging (exclude approved admin accounts)
level: critical
tags:
    - attack.impact
    - attack.t1490
    - attack.t1560.001
    - attack.t1567

// STORM Ransomware Pre-Detonation Hunt — correlate lateral movement + staging + VSS tampering per device
let TimeWindow = 48h;
let SuspiciousRemoteExec =
    DeviceProcessEvents
    | where TimeGenerated > ago(TimeWindow)
    | where FileName in~ ("psexec.exe", "wmic.exe", "wmiprvse.exe")
       or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Invoke-WMIMethod", "Enter-PSSession", "New-PSSession"))
    | project RemoteExecTime = TimeGenerated, DeviceName, InitiatingProcessAccountName, ProcessCommandLine;
let DataStaging =
    DeviceProcessEvents
    | where TimeGenerated > ago(TimeWindow)
    | where FileName in~ ("rclone.exe", "7z.exe", "rar.exe", "megacmd.exe", "filezilla.exe")
       or ProcessCommandLine has_any ("rclone copy", "rclone sync", "--transfers", "mega.nz", "mega.io")
    | project StagingTime = TimeGenerated, DeviceName, StagingCmd = ProcessCommandLine, StagingAccount = InitiatingProcessAccountName;
let VSSTamper =
    DeviceProcessEvents
    | where TimeGenerated > ago(TimeWindow)
    | where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "resize shadowstorage",
                                        "delete catalog", "recoveryenabled no", "bcdedit")
    | project VSSTime = TimeGenerated, DeviceName, VSSCmd = ProcessCommandLine, VSSAccount = InitiatingProcessAccountName;
SuspiciousRemoteExec
| join kind=inner DataStaging on DeviceName
| join kind=inner VSSTamper on DeviceName
| where StagingTime between (RemoteExecTime .. VSSTime)
| summarize FirstRemoteExec = min(RemoteExecTime), StagingEvents = count(),
            StagingCommands = make_set(StagingCmd, 5), VSSTamperTime = min(VSSTime)
  by DeviceName, InitiatingProcessAccountName
| extend KillChainWindowMinutes = datetime_diff("minute", VSSTamperTime, FirstRemoteExec)
| order by VSSTamperTime desc
// Any hit = assume active pre-encryption stage. Isolate host immediately and invoke IR plan.

# Security Arsenal - STORM Ransomware Rapid Triage Script
# Run as Administrator. Outputs findings to console + CSV for escalation.
# Usage: .	riage-storm.ps1 [-OutputPath C:\IR\]

param([string]$OutputPath = ".\STORM_Triage_$(Get-Date -Format 'yyyyMMdd_HHmm')")
New-Item -ItemType Directory -Path $OutputPath -Force | Out-Null
$findings = @()

Write-Host "[1/5] Checking RDP exposure and NLA status..." -ForegroundColor Cyan
$rdp = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -ErrorAction SilentlyContinue
$nla = Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name UserAuthentication -ErrorAction SilentlyContinue
if ($rdp.fDenyTSConnections -eq 0) {
    $sev = if ($nla.UserAuthentication -ne 1) { 'CRITICAL - RDP enabled WITHOUT NLA' } else { 'WARN - RDP enabled (NLA on)' }
    $findings += [pscustomobject]@{Check='RDP Exposure'; Severity=$sev; Detail="fDenyTSConnections=0, NLA=$($nla.UserAuthentication)"}
}

Write-Host "[2/5] Enumerating scheduled tasks created in the last 7 days..." -ForegroundColor Cyan
$cutoff = (Get-Date).AddDays(-7)
Get-ScheduledTask | ForEach-Object {
    $info = $_ | Get-ScheduledTaskInfo -ErrorAction SilentlyContinue
    if ($_.Date -and ([datetime]$_.Date) -gt $cutoff) {
        $findings += [pscustomobject]@{Check='New Scheduled Task'; Severity='HIGH'; Detail="$($_.TaskName) | $($_.TaskPath) | Created: $($_.Date) | Action: $($_.Actions.Execute) $($_.Actions.Arguments)"}
    }
}

Write-Host "[3/5] Checking for suspicious services (PsExec clones, random names) installed in last 7 days..." -ForegroundColor Cyan
Get-CimInstance Win32_Service | Where-Object {
    $_.InstallDate -gt $cutoff -or $_.Name -match 'PSEXESVC|^[a-z0-9]{6,8}$'
} | ForEach-Object {
    $findings += [pscustomobject]@{Check='Suspicious Service'; Severity='HIGH'; Detail="$($_.Name) | $($_.PathName) | State: $($_.State)"}
}

Write-Host "[4/5] Validating Volume Shadow Copy integrity..." -ForegroundColor Cyan
$shadows = Get-CimInstance Win32_ShadowCopy -ErrorAction SilentlyContinue
if (-not $shadows) {
    $findings += [pscustomobject]@{Check='Shadow Copies'; Severity='CRITICAL - NO SHADOW COPIES EXIST'; Detail='Possible vssadmin/wmic deletion - treat as pre-encryption indicator'}
} else {
    $findings += [pscustomobject]@{Check='Shadow Copies'; Severity='INFO'; Detail="$($shadows.Count) shadow copies present, oldest: $(($shadows | Sort-Object InstallDate | Select-Object -First 1).InstallDate)"}
}

Write-Host "[5/5] Scanning for staging tools (rclone/7z/megacmd) and large recent archives..." -ForegroundColor Cyan
$stagingPaths = @("$env:TEMP","C:\ProgramData","C:\Users\Public")
foreach ($p in $stagingPaths) {
    Get-ChildItem $p -Recurse -Include rclone.exe,megacmd.exe,rar.exe -ErrorAction SilentlyContinue | ForEach-Object {
        $findings += [pscustomobject]@{Check='Staging Tool Found'; Severity='CRITICAL'; Detail="$($_.FullName) | LastWrite: $($_.LastWriteTime)"}
    }
    Get-ChildItem $p -Recurse -Include *.zip,*.7z,*.rar -ErrorAction SilentlyContinue |
      Where-Object { $_.Length -gt 500MB -and $_.LastWriteTime -gt $cutoff } | ForEach-Object {
        $findings += [pscustomobject]@{Check='Large Recent Archive'; Severity='HIGH'; Detail="$($_.FullName) | $([math]::Round($_.Length/1GB,2)) GB | $($_.LastWriteTime)"}
    }
}

$findings | Export-Csv "$OutputPath\findings.csv" -NoTypeInformation
Write-Host "`n===== TRIAGE SUMMARY =====" -ForegroundColor Yellow
$findings | Sort-Object Severity | Format-Table -AutoSize -Wrap
Write-Host "Results exported to $OutputPath\findings.csv" -ForegroundColor Green
Write-Host "If ANY CRITICAL findings exist: isolate host from network NOW and escalate to IR." -ForegroundColor Red