Stormous is one of the few exceptions. Aside from being a backdoor, it also contains ransomware functionality.
Stormous
Stormous is a PHP-based malware family associated with the Stormous ransomware operation.
Profile source: Mallory opens in a new tabStormous
Family profile
Stormous is a PHP-based malware family associated with the Stormous ransomware operation. It has been described as unusual among ransomware tooling because it combines backdoor functionality with file-encryption and ransom-note deployment, allowing operators to obtain remote access to compromised servers and then deliver additional custom payloads. Reported capabilities include malware dropping, remote access for follow-on activity, and ransomware execution.
Stormous has been publicly aligned with pro-Russian messaging during the Russia-Ukraine conflict and declared intent to target Ukrainian government institutions. Analysis has linked the operation to Arabic-speaking actors, likely from North Africa. The malware has been characterized as rapidly modifiable, reflecting its PHP implementation and use against web-facing environments.
Targeting has focused on web servers and vulnerable web applications running PHP. Stormous is primarily known as part of a ransomware and extortion operation rather than a commodity malware family, and it has appeared in multiple ransomware activity rankings and leak-site tracking during 2023 and 2025. The group has also operated a data leak site and, in some periods, relied on Telegram for victim disclosures and extortion-related publicity.
Capabilities
- Exfiltration
- Post Exploitation
Operational record
1
YARA rules
4
Leak sites
0 available
Reported operators
Threat actors
1 named in public reportingMITRE ATT&CK
Stormous in ATT&CK
35 distinct techniquesTechniques
35 techniques T1505.003 Web Shell T1059 Command and Scripting Interpreter T1486 Data Encrypted for Impact T1059.006 Python T1190 Exploit Public-Facing Application T1078 Valid Accounts T1199 Trusted Relationship T1566 Phishing T1566.001 Phishing: Spearphishing Attachment T1059.005 Command and Scripting Interpreter: Visual Basic T1204.002 User Execution: Malicious File T1053 Scheduled Task/Job T1098 Account Manipulation T1543.003 Create or Modify System Process: Windows Service T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1548.002 Abuse Elevation Control Mechanism: Bypass UAC T1027 Obfuscated Files or Information T1027.002 Obfuscated Files or Information: Software Packing T1027.011 Obfuscated Files or Information: Fileless Storage T1027.013 Obfuscated Files or Information: Encrypted/Encoded File T1070 Indicator Removal T1562.001 Impair Defenses: Disable or Modify Tools T1003 OS Credential Dumping T1046 Network Service Discovery T1083 File and Directory Discovery T1021.001 Remote Services: Remote Desktop Protocol T1021.002 Remote Services: SMB/Windows Admin Shares T1005 Data from Local System T1560 Archive Collected Data T1041 Exfiltration Over C2 Channel T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage T1071.001 Application Layer Protocol: Web Protocols T1490 Inhibit System Recovery T1588.002 Obtain Capabilities: Tool T1595 Active Scanning
Reporting
Research mentioning Stormous
Aug 12
Hookphish
Ransomware Group clop Hits: HONGHE-TECH.COM
The Clop ransomware operation has repeatedly targeted enterprise networks with intrusions that begin with phishing or exploitation of exposed systems, followed by manual lateral movement, credential theft, and domain-wide deployment. Reporting from ANSSI and AhnLab linked earlier campaigns to TA505, describing attacks in which operators used tools such as Cobalt Strike and Mimikatz, encrypted files with .Clop or .CIop extensions, and disrupted business operations at victims including E-Land Group, Software AG, and reportedly Indiabulls Group. Analysts also observed Clop using signed malware components, targeting Active Directory environments, stopping business-critical services before encryption, and in some cases preserving shadow copies depending on the variant. The group increasingly shifted from encryption-only attacks to double extortion and broader data-leak pressure tactics. Clop operators published stolen files on leak sites, demanded multimillion-dollar payments, contacted victims' customers directly to intensify pressure, and were tied to mass data-theft campaigns exploiting managed file transfer flaws such as CVE-2023-0669 in Fortra GoAnywhere MFT, which was linked to theft from about 130 companies. More recent victim listings attributed to Clop include organizations in the U.S., Canada, Peru, China, Taiwan, and Europe across technology, manufacturing, retail, and other sectors, underscoring the group's continued global focus on enterprise-scale ransomware and data-breach operations.
Aug 12
Hookphish
Ransomware Group clop Hits: 9ALTITUDES.COM
Aug 12
Hookphish
Ransomware Group clop Hits: WATERLANDPE.COM
Aug 12
Hookphish
Ransomware Group clop Hits: NETPOWER.COM
Aug 12
Hookphish
Ransomware Group clop Hits: ALDOGROUP.COM (ALDOSHOES.COM)
Aug 12
Hookphish
Ransomware Group clop Hits: IRCO.COM
Aug 12
Hookphish
Ransomware Group clop Hits: LARGAN.COM.TW
Apr 19
Bleeping Computer
