Stormous Ransomware: Complete Guide

Stormous is a ransomware group that targets various entities, including websites, companies, and organizations in the United States and Ukraine. They have claimed responsibility for cyber attacks on major American brands such as Coca-Cola, Mattel, and Danaher. They have also attacked the Ukraine Ministry of Foreign Affairs and obtained sensitive information.

Stormous has proclaimed support for Russia in its war with Ukraine. They have capitalized on the escalating tensions between the two countries to establish a name for themselves. However, there is debate among experts about whether their claims are politically motivated or driven by financial gain.

Stormous has engaged in ransomware operations, encrypting victims’ data and demanding payment for its release. They have also claimed to leak data from targeted organizations if their ransom demands are not met. In some cases, they have published sensitive information to further damage the reputation of their victims.

SalvageData experts recommend proactive data security measures, such as regular backups, strong cybersecurity practices, and keeping software up to date, to protect against ransomware attacks. And, in case of a ransomware attack, contact our ransomware recovery experts immediately.

What kind of malware is Stormous?

Stormous is ransomware, which is a type of malware that encrypts and locks the victims’ files and then requests a ransom in exchange for the decryption key.

The Stormous ransomware group has been active since 2021 and they declare themselves as a group of Arabic-speaking hackers. They declared they support the Russian government in its war against Ukraine.

The hacker group is known for website defacement and information theft.

Everything we know about Stormous Ransomware

Confirmed Name

• Stormous virus

Threat Type

• Ransomware
• Crypto Virus
• Files locker
• Double extortion

Encrypted Files Extension

• No file extension related to Stormous ransomware was released

Is There a Free Decryptor Available?

No, Stormous ransomware does not have a decryptor

Detection Names

• Avast Other:Malware-gen [Trj]
• AVG Other:Malware-gen [Trj]
• Emsisoft Trojan.Ransom.PHP (B)
• Kaspersky Trojan-Ransom.PHP.Stormous.a
• Sophos PHP/Ransom-EUL
• Microsoft Trojan:Script/Malgent!MSR

Distribution methods

• Phishing emails
• Exploiting vulnerabilities
• Remote desktop protocol (RDP)
• Ads and pop-ups
• Credential abuse

Consequences

• Files are encrypted and locked until the ransom payment
• Data leak
• Double extortion

What is in the Stormous ransom note

The Stormous ransom note is written in Arabic. Its specific contents, however, are not known.

Researchers strongly believe that Stormous is a scam and the group is trying to capture attention to themselves.

If you realize you’re a ransomware victim, contacting SalvageData ransomware removal experts provides you with a secure data recovery service and ransomware removal after an attack.

How does Stormous infect a system

Stormous ransomware gains access to systems through various infection vectors, including:

• Phishing emails. Phishing emails are one of the most common infection vectors used by ransomware, including Stormous. These emails may contain malicious attachments or links that, when clicked, download and execute the ransomware. In the case of Stormous, these emails contain messages pretending to be organizations that help victims of the war in Ukraine.

• Exploiting vulnerabilities. Stormous may exploit vulnerabilities in software or operating systems to gain access to systems. This can include unpatched systems, websites, and VPN servers.
• Remote desktop protocol (RDP). RDP is a protocol that allows users to remotely access a computer or server. If RDP is not properly secured, it can be used as an entry point for ransomware attacks, including Stormous.
• Ads and pop-ups. Ads and pop-ups on websites can also be used as an infection vector for ransomware, including Stormous.
• Credential abuse. Credential abuse involves using stolen or weak login credentials to gain access to systems.

How does Stormous ransomware work

Stormous ransomware works by following a typical ransomware attack pattern. While specific details about Stormous ransomware are limited, we can infer how it operates based on general knowledge about ransomware attacks.

1. Initial infection

Stormous ransomware gains access to a computer or network through various methods, such as exploiting software vulnerabilities, phishing emails, or Remote Desktop Protocol (RDP) attacks.

2. File encryption

Once inside the system, Stormous ransomware starts encrypting files on the infected machine and potentially on connected network drives.

3. Ransom payment

The ransom note demands payment in exchange for the decryption key and not leak the stolen data. The attackers usually require payment in cryptocurrencies like Bitcoin to make it difficult to trace the transactions.

Do not pay the ransom! Contacting a ransomware removal service can not only restore your files but also remove any potential threat.

How to handle a Stormous ransomware attack

The first step to recover from a Stormous attack is to isolate the infected computer by disconnecting from the internet and removing any connected device. Then, you must contact local authorities. In the case of US residents and businesses, it is the local FBI field office and the Internet Crime Complaint Centre (IC3).

To report a ransomware attack you must gather every information you can about it, including:

• Screenshots of the ransom note
• Communications with threat actors (if you have them)
• A sample of an encrypted file

However, if you prefer to contact professionals, then do nothing. Leave every infected machine the way it’s and ask for an emergency ransomware removal service. Restarting or shutting down the system may compromise the recovery service. Capturing the RAM of a live system may help get the encryption key, and catching a dropper file, i.e. file executing the malicious payload, might be reverse-engineered and lead to decryption of the data or understanding how it operates.

You must not delete the ransomware, and keep every evidence of the attack. That’s important for digital forensics so experts can trace back to the hacker group and identify them. It is by using the data on your infected system that authorities can investigate the attack and find the responsible. A cyber attack investigation is not different from any other criminal investigation: it needs evidence to find the attackers.

1. Contact your Incident Response provider

A Cyber Incident Response is the process of responding to and managing a cybersecurity incident. An Incident Response Retainer is a service agreement with a cybersecurity provider that allows organizations to get external help with cybersecurity incidents. It provides organizations with a structured form of expertise and support through a security partner, enabling them to respond quickly and effectively during a cyber incident.

An incident response retainer offers peace of mind to organizations, offering expert support before and in the aftermath of a cybersecurity incident. An incident response retainer’s specific nature and structure will vary according to the provider and the organization’s requirements. A good incident response retainer should be robust but flexible, providing proven services to enhance an organization’s long-term security posture.

If you contact your IR service provider, they will care for everything else. However, if you decide to remove the ransomware and recover the files with your IT team, then you can follow the next steps.

2. Identify the ransomware infection

You can identify which ransomware infected your machine by the file extension (some ransomware uses the file extension as their name), using a ransomware ID tool, or it will be on the ransom note. With this information, you can look for a public decryption key.

You can also check the ransomware type by its IOCs. Indicators of Compromise (IOCs) are digital clues that cybersecurity professionals use to identify system compromises and malicious activities within a network or IT environment. They are essentially digital versions of evidence left at a crime scene, and potential IOCs include unusual network traffic, privileged user logins from foreign countries, strange DNS requests, system file changes, and more. When an IOC is detected, security teams evaluate possible threats or validate its authenticity. IOCs also provide evidence of what an attacker had access to if they did infiltrate the network.

Stormous ransomware file hashes

• 96ba3ba94db07e895090cdaca701a922523649cf6d6801b358c5ff62416be9fa
• b7863120606168b3731395d9850bbf25661d05c6e094c032fc486e15daeb5666

3. Remove the ransomware and eliminate exploit kits

Before recovering your data, you must guarantee that your device is ransomware-free and that the attackers can’t make a new attack through exploit kits or other vulnerabilities. A ransomware removal service can delete the ransomware, create a forensics document for investigation, eliminate vulnerabilities, and recover your data.

4. Use a backup to restore the data

Backups are the most efficient way to recover data. Make sure to keep daily or weekly backups, depending on your data usage.

5. Contact a ransomware recovery service

If you don’t have a backup or need help removing the ransomware and eliminating vulnerabilities, contact a data recovery service. Paying the ransom does not guarantee your data will be returned to you. The only guaranteed way you can restore every file is if you have a backup of it. If you don’t, ransomware data recovery services can help you decrypt and recover the files.

SalvageData experts can safely restore your files and prevent Stormous ransomware from attacking your network again.

Contact our experts 24/7 for emergency recovery service.

Prevent the Stormous ransomware attack

Preventing ransomware is the best solution for data security. is easier and cheaper than recovering from them. Stormous ransomware can cost your business’s future and even close its doors.

These are a few tips to ensure you can avoid ransomware attacks:

• Antivirus and anti-malware
• Use cybersecurity solutions
• Use strong passwords
• Updated software
• Updated operating system (OS)
• Firewalls
• Have a recovery plan in hand (See how to create a data recovery plan with our in-depth guide)
• Schedule regular backups
• Don’t open an email attachment from an unknown source
• Do not download files from suspicious websites
• Don’t click on ads unless you’re sure it’s safe
• Only access websites from trustworthy sources