Storm Ransomware Is Scaling Fast and Selling an AI Powered Image

A new ransomware operation appeared in August 2026 with an ambitious pitch: sophisticated infrastructure, aggressive affiliate payouts, global ambitions, and what it calls the “first AI powered, quantum resistant ransomware.”

Within approximately six weeks, Storm had claimed over 50 victims across North America, Europe, and Oceania. Its targets span healthcare, finance, manufacturing, business services, government, transportation, and critical infrastructure.

Storm arrived with the structure of an established Ransomware as a Service operation. Its affiliate program offers revenue shares reaching 90%, while its leak site looks closer to a commercial software platform, complete with an interactive victim map, search functionality, sector filters, victim tracking, and document previews.

Storm heavily promotes itself as AI powered. Check Point Exposure Management researchers found no evidence showing AI use in the group’s ransomware deployment, victim targeting, encryption routines, or extortion processes. The AI message appears closely tied to how Storm recruits affiliates, promotes automation, and builds its brand. Figure 1, Storm’s pinned darknet recruitment post advertising itself as AI powered and showing its affiliate offer

• Storm scaled quickly. The group claimed over 50 victims within approximately six weeks of public activity across North America, Europe, and Oceania.
• It launched as a structured affiliate operation. Storm advertises lockers for Windows, Linux, ESXi, and NAS, along with victim chat management, call center services, AV and EDR bypass support, DDoS capabilities, and media outreach.
• Affiliates can receive up to 90% of revenue. Storm advertises a tiered model starting at 75%, rising to 80%, and reaching 90% for revenue above $750,000.
• Healthcare featured heavily in its early activity. Six healthcare organizations appear among the early victim claims, alongside victims across finance, manufacturing, retail, automotive, and other sectors.
• Its leak site is unusually polished. Storm built an interactive platform featuring a global victim map, industry filters, search, victim timelines, document previews, and a custom CAPTCHA.
• The AI branding remains unverified. Researchers found no conclusive evidence that AI supports Storm’s intrusion, encryption, extortion, or affiliate workflows.

Storm’s public emergence was closely tied to affiliate recruitment.

Before its first observed victim publication, known Initial Access Broker BigBro advertised the new operation on a darknet forum. Storm later published its own pinned recruitment post, formalizing its RaaS offering.

The offering resembles a service catalog. Affiliates gain access to ransomware lockers, technical support, victim communication capabilities, call center services, DDoS capabilities, and other resources. Storm also openly solicits Initial Access Brokers, data brokers, and network access providers.

Its revenue sharing model adds another recruitment incentive. Affiliates can retain up to 90% of revenue once earnings exceed $750,000.

Storm claimed over 50 victims during its first six weeks, with observed organizations in the United States, Germany, Canada, and Australia.

Business services accounted for 13 observed incidents, followed by finance with nine and manufacturing with seven. Retail and healthcare each accounted for six.

Figure 2, Storm sector targeting distribution

Healthcare stands out in Storm’s early activity. Victim claims included hospitals, health networks, treatment providers, radiology organizations, and hospice services. Researchers assess that the early concentration suggests deliberate targeting of organizations where disruption can create significant pressure to pay.

Storm’s leak site reinforces the group’s focus on presentation and scale.

The Tor based site includes an interactive global map displaying victim locations, industry filtering, searchable victim listings, timelines, document tree previews, and a custom graphical CAPTCHA.

Figure 3, Storm’s advanced data leak site and interactive victim map

The investment provides Storm with infrastructure for managing victims while supporting affiliate recruitment, media visibility, and brand recognition.

Storm repeatedly describes itself as the “first AI powered, quantum resistant ransomware.”

Researchers found no conclusive evidence supporting AI use in intrusion, encryption, extortion, or affiliate support workflows. Current evidence points toward three roles for the AI narrative: recruitment, automation signaling, and marketing.

AI gives Storm a way to stand out in a crowded ransomware ecosystem and present itself as technologically advanced. References to automated victim management and negotiations may also signal workflow automation, though the available evidence does not establish AI enhanced offensive capabilities.

Storm’s rapid growth shows how quickly a ransomware operation can establish scale through structured affiliate recruitment, polished infrastructure, and aggressive branding.

For the complete analysis of Storm’s emergence, victimology, affiliate model, leak site, and AI claims, read the full report: Storm: Ransomware in the Age of AI

Learn how Check Point Exposure Management helps organizations monitor ransomware groups across the dark web, track emerging threat actor activity, and identify potential risks to their organization.