Description Summary
~185 victims; pro-Russian; STMX_GhostLocker RaaS with GhostSec.
Threat Actor
Pro-Russian; member of 'The Five Families' collective.
Technical Indicators
Encryption Extension
.stormous / .F5 / .ghost
Encryption Algorithm
AES-256 + RSA (Go); StormCry (Python) + GhostLocker 2.0 (Golang)
Ransom Note Name
Not publicly reported
Targeted Industries
Technology, Business services
First Seen
2021 (STMX_GhostLocker RaaS with GhostSec, March 2024)
Last Seen
Active (~185 victims)
Geographical Location
US, Spain, UAE, France, Brazil
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |