Threat Intelligence Report March 11 - March 17 2025

Stormous ransomware

Stormous ransomware, operating in close collaboration with GhostSec, has evolved into a sophisticated and formidable threat actor. Their operations blend advanced intrusion techniques—including VPN credential compromise, lateral movement using legitimate tools, DLL sideloading, and exploitation of vulnerable drivers—with a double-extortion business model. This report details their attack chain, technical indicators (IOCs), and mitigation recommendations. It also highlights findings from recent threat intelligence (Red Piranha, May 7–May 13, 2024) and compares IOCs that show overlapping onion infrastructure between Stormous and GhostSec.

Overview

• Evolution & Collaboration:
  Stormous has recently aligned with GhostSec to launch a combined ransomware-as-a-service (RaaS) platform. This partnership facilitates a wider distribution of advanced payloads while using shared dark web infrastructure—most notably, common onion URLs for command-and-control (C2) and leak sites.
• Operational Tactics:
  The group gains initial access via compromised VPN credentials and escalates privileges using both legitimate administrative tools and covert techniques (e.g., DLL sideloading and vulnerable driver exploitation). Once inside, they encrypt files using robust AES-256 encryption and exfiltrate data, which is later used to pressure victims through public data leaks.
• Double-Extortion Model:
  In addition to encrypting victim files (typically appending a “.ghost” extension), Stormous exfiltrates sensitive data. If ransom demands are not met, the stolen data is published on dedicated leak sites, heightening the stakes for affected organisations.

Attack Chain Analysis

1. Initial Access

• Technique: Credential Theft & VPN Compromise
• Description:
  Attackers leverage stolen or weak VPN credentials to establish extended remote sessions. Long-duration sessions from atypical IP addresses are indicative of bypassed multifactor authentication and other security controls.

2. Execution & Lateral Movement

• Technique: Remote Desktop Protocol (RDP) & Administrative Tools
• Description:
  Post-compromise, attackers use RDP along with tools like PsExec and Windows Management Instrumentation (WMI) to spread laterally. This approach enables them to mimic legitimate user behaviour and remain undetected.

3. EDR Evasion & Privilege Escalation

• Technique: DLL Sideloading and Exploitation of Vulnerable Drivers
• Description:
  By replacing trusted DLLs (e.g., avupdate.dll) with malicious versions loaded by legitimate executables (such as upd.exe), the attackers bypass security checks. They further escalate privileges by exploiting a signed yet vulnerable driver (TPwSav.sys) to disable kernel-level security and remove EDR hooks.

4. Impact: Data Encryption & Exfiltration

• Technique: AES-256 Encryption and Data Exfiltration
• Description:
  After gaining control, the ransomware encrypts files (often appending a “.ghost” extension) and drops a ransom note (typically in HTML format) containing negotiation instructions. Simultaneously, sensitive data is exfiltrated to remote servers, which serves as a basis for subsequent public leaks if ransoms are not paid.

Detailed TTB Chart

Below is a table detailing the Tactics, Techniques, and Behaviours (TTB) used by Stormous in their attack chain:

IOCs

Tox: C286720F7592E5668A932F1D06EDEECBAFACB3BE369632C908F9511D072C142575BA8109CBC6

URLs

File servers

http://6sf5xa7eso3e3vk46i5tpcqhnlayczztj7zjktzaztlotyy75zs6j7qd.onion

Ransomware Victims Worldwide

A recent ransomware analysis reveals that the United States remains the most heavily impacted nation, accounting for a staggering 49.72% of global incidents, emphasising its continued vulnerability to ransomware threats.

Following the United States, India reported 5.65% of ransomware attacks, making it the second most targeted country in this period. Taiwan also experienced a high rate of incidents, contributing 5.08% to global cases. Canada reported 3.39% of attacks, emerging as another heavily targeted region.

Countries like the United Kingdom (4.52%), France (2.26%), Germany (2.26%), Italy (2.26%), Australia (2.26%), and China (2.82%) have also faced considerable ransomware exposure, underlining ongoing risks in these regions.

Nations such as Spain (1.13%), Brazil (1.69%), Poland (1.13%), Malaysia (1.13%), Peru (1.13%), Austria (1.13%), and Turkey (1.13%) experienced moderate ransomware activity, reflecting persistent but slightly lower levels of targeting.

Several other countries, including the United Arab Emirates, Denmark, Switzerland, Costa Rica, New Zealand, Slovakia, Dominican Republic, Pakistan, Argentina, Laos, Singapore, Thailand, Japan, Monaco, Norway, Egypt, Iraq, Ukraine, and Colombia, each recorded 0.56% of global ransomware cases, highlighting that the ransomware threat remains widespread and not confined to specific regions.

This analysis underscores the persistent and global nature of ransomware attacks, with North America and Asia facing particularly high levels of risk. These findings highlight the critical need for robust cybersecurity frameworks, proactive defence mechanisms, and heightened vigilance across all sectors to combat the evolving ransomware landscape worldwide.