// THREAT ACTOR
STORM_
ActiveSTORM is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of STORM — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2026 7
Leak site mirrors
1 mirror tracked, 1 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
yqhecvqtdvq6p7duqcgw2qca77spbgakxcoibtx6zpvfshltsbbbhfqd.onionStorm Blog snapshot · 2026-08-06 21:04
Recent victims
The 50 most recent victims claimed by STORM. Total in the index: 7.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-06 | Pioneer Bank | FinTech | Albany, New York, United States | Pioneer Bank is a leading … |
| 2026-08-06 | NCA Alarms | NCA Alarms specializes in home and commercial security systems, offeri… |
| 2026-08-06 | Nelson Manufacturing | Nelson Manufacturing Company specializes in the design and production … |
| 2026-08-06 | Southern Indiana Radiological Associates | Southern Indiana Radiological Associates provides a comprehensive rang… |
| 2026-08-06 | Liberty Healthcare Corporation | Liberty Healthcare Corporation is a prominent health and human service… |
| 2026-08-06 | EvansPetree | Evans Petree has maintained a strong and effective dispute resolution/… |
| 2026-08-06 | OVP Health | OVP Health is a physician-owned company with over 20 years of experien… |