Storm Ransomware Claims 50+ Victims in Six Weeks, but Its AI Label Is Unproven
A new ransomware operation called Storm has claimed more than 50 victims in roughly six weeks, while marketing itself as the "first AI powered, quantum resistant ransomware." Check Point Exposure Management researchers say they found no evidence that AI is actually used in its attacks.
- Storm appeared in August 2026 and claimed over 50 victims in about six weeks, per Check Point.
- Affiliates can receive up to 90% of revenue, with tiers starting at 75% and rising to 80%.
- Business services (13), finance (9) and manufacturing (7) led the observed incidents; healthcare had six.
- Check Point found no conclusive evidence that AI is used in Storm's attacks.
- The AI branding appears tied to recruitment, automation signaling, and marketing.
A structured affiliate operation from day one
Storm appeared in August 2026 and, according to Check Point, arrived with the structure of an established Ransomware as a Service (RaaS) operation. Within approximately six weeks it had claimed over 50 victims across North America, Europe, and Oceania. Observed organizations were located in the United States, Germany, Canada, and Australia.
Its public emergence was closely tied to recruitment. Before the first observed victim publication, a known Initial Access Broker called BigBro advertised the new operation on a darknet forum. Storm later published its own pinned recruitment post, which formalized the RaaS offering.
The offering reads like a service catalog. Check Point says Storm advertises:
- lockers for Windows, Linux, ESXi, and NAS
- victim chat management and call center services
- AV and EDR bypass support
- DDoS capabilities and media outreach
The group also openly solicits Initial Access Brokers, data brokers, and network access providers.
Revenue shares up to 90% and a polished leak site
Storm uses its payout model as a recruitment incentive. Check Point describes a tiered structure that starts at 75%, rises to 80%, and reaches 90% for revenue above $750,000.
The group's Tor based leak site also stands out. It includes an interactive global victim map, industry filtering, searchable victim listings, timelines, document tree previews, and a custom graphical CAPTCHA. Check Point says the site looks closer to a commercial software platform than a typical leak page, and that the investment gives Storm infrastructure for managing victims while supporting affiliate recruitment, media visibility, and brand recognition.
By sector, business services accounted for 13 observed incidents, followed by finance with nine and manufacturing with seven. Retail and healthcare each accounted for six.
Healthcare features heavily in the early activity. Victim claims included hospitals, health networks, treatment providers, radiology organizations, and hospice services. Researchers assess that this early concentration suggests deliberate targeting of organizations where disruption can create significant pressure to pay.
The AI claim remains unverified
Storm repeatedly describes itself as the "first AI powered, quantum resistant ransomware," according to Check Point. The researchers, however, found no conclusive evidence of AI use in intrusion, encryption, extortion, or affiliate support workflows.
Check Point instead sees three roles for the AI narrative: recruitment, automation signaling, and marketing. The label helps Storm stand out in a crowded ransomware ecosystem and appear technologically advanced. References to automated victim management and negotiations may point to workflow automation, but the available evidence does not establish AI enhanced offensive capabilities.
What it means
Check Point's reading is that Storm shows how quickly a ransomware operation can reach scale through structured affiliate recruitment, polished infrastructure, and aggressive branding. For defenders, the finding suggests that the threat lies in the group's organization and reach, not in any confirmed AI capability. Check Point has published a full report titled "Storm: Ransomware in the Age of AI" covering the group's victimology, affiliate model, leak site, and AI claims.
Check Point: Storm Ransomware Is Scaling Fast and Selling an AI Powered Image
