Dark Storm Team: Operations, Alliances and DDoS-for-Hire Services

Over the past few years, hacktivist groups have become more organised in how they operate and present themselves online. What once started as small, loosely connected collectives has gradually developed into a network of groups that maintain multiple Telegram channels, announce alliances, cross-promote attack claims, and use major geopolitical events to gain visibility.

Dark Storm Team is one such group. First observed in late 2023, it gained widespread attention in March 2025 after claiming responsibility for a large-scale outage affecting X (formerly Twitter). The incident brought the group into the spotlight, attracting attention from media outlets, cybersecurity researchers, and even Elon Musk himself.

Despite the attention, there is still no clear picture of what Dark Storm Team actually represents. It has been described as a pro-Palestinian hacktivist group, associated with the pro-Russian hacktivist ecosystem, and linked to the commercial sale of DDoS attacks. These descriptions are not necessarily contradictory, but they raise questions about the group's actual structure, affiliations, and activities beyond its public attack claims.

To get a closer look, this investigation moved beyond public reporting and focused on Dark Storm Team's own activity across Telegram. Using StealthMole, we followed the group's channels, tracked changes in its online presence, and examined the accounts and communities interacting with it. The investigation revealed a network built around a recurring persona, multiple channel migrations, a steady stream of claimed attacks, commercial DDoS offerings, and connections with other hacktivist groups.

The Face Behind the Storm

Behind Dark Storm Team's public activity is a recurring persona known as GLITCH. Across the Telegram channels examined during this investigation, GLITCH consistently appeared as the group's owner, spokesperson, and point of contact for its commercial services. He announced new channels, published attack claims, issued threats against critical infrastructure, and personally handled purchase enquiries.

His public statements also made little attempt to hide the group's intentions. In May 2026, he posted a direct threat against critical infrastructure, stating that the group would attack it "when I want". The message ended with a simple signature: "-GLITCH".

However, the account behind this persona has not remained the same. On 1 May 2025, a pinned message in the Dark Storm chat announced that Telegram had banned the team's owner and that an investigation was underway. By the following day, GLITCH had returned under a different account. He told members that his previous account had been banned without explanation and added that the group now knew "how to not ban again".

Using StealthMole's Telegram Tracker, we pivoted from GLITCH's known user nodes to identify the accounts associated with the persona. This revealed several accounts used for different purposes over time:

• Main owner account used since May 2025: @MRHEL***1 (User ID: 6147437922)
• Declared backup account: @MRHEL****3 (User ID: 8398245341)
• Account used for sales and service enquiries, renamed in mid-2026: @glitch****1 → @MRHEL*****2 (User ID: 8797265807)
• Earlier owner account, banned in May 2025: @DarkStorm****3

GLITCH was relatively open about these connections. In November 2025, he published a message explicitly identifying his main and backup accounts. The sales account followed a similar pattern. Between May and July 2026, Dark Storm's service advertisements directed potential buyers to @glitch******1. From July onwards, the same Telegram user ID, 8797265807, appeared under the new username @MRHEL******2. The account continued to handle the group's sales advertisements.

A more revealing connection emerged on 21 October 2026, when GLITCH appeared in a Telegram chat called DDoSia Project. The group is used by NoName057(16) volunteers operating the group's DDoS client. GLITCH introduced himself with the message "its me darkstorm" and then asked whether anyone recognised him.

When another participant jokingly questioned whether he was really the administrator of Dark Storm, GLITCH replied, "i am owner". A responder answered in Russian that they already knew and that there was no need to announce it.

The exchange provided a direct example of GLITCH identifying himself as Dark Storm's owner in a community associated with another hacktivist operation.

The conversation became more unusual shortly afterwards. GLITCH wrote that he needed help "from putin to use nuclear on usa, europe". Another participant pointed out that his profile indicated he was from Russia and questioned why he was communicating in English. GLITCH responded in Russian, explaining that he did not speak with many Russians.

While the exchange offered a glimpse into how GLITCH presents himself within other hacktivist communities, it did not establish a formal relationship between Dark Storm and NoName057(16). What it did confirm was that the persona was willing to publicly identify himself as the owner of Dark Storm in a chat associated with the DDoSia project.

But identifying the operator behind an online persona is a different challenge altogether.

On 7 October 2025, an Indian hacktivist channel published a post titled "Owner of TEAM DARK STORM". The post was subsequently forwarded into the Bhartiya Hunters chat. It listed two of GLITCH's Telegram accounts alongside their user IDs, followed by what it claimed were the owner's real identity, contact details, address, and Facebook profile.

At first, the post appeared worth investigating. The Telegram handles and user IDs matched accounts already associated with GLITCH. However, this did not independently validate the identification. Those account details had already been publicly disclosed by GLITCH himself, meaning they offered no new evidence of the operator's real-world identity.

We then examined the remaining information through StealthMole. Several inconsistencies emerged. The post combined several details within the same profile, while the document number it provided appeared to be a sequence of digits taken directly from the listed phone number. A pivot using the associated landline in StealthMole's Dark Web Tracker returned only unrelated database dumps in which the same digits appeared as record values.

The Facebook profile associated with the listed mobile number was consistent with the name mentioned in the post. However, there was no evidence connecting that profile, phone number, or identity to any of GLITCH's Telegram accounts.

The source was a rival hacktivist group, the information could not be independently corroborated, and the inconsistencies raised further questions about its reliability.

Built to Survive Bans

If there is one thing Dark Storm Team has demonstrated over time, it is its ability to rebuild its online presence after repeated platform bans.

Telegram has removed several of the group's channels, chat groups, and owner accounts. However, each removal was followed by a replacement, often within a short period. New links were circulated through backup channels, existing chat groups, and allied hacktivist communities. By tracing these changes through StealthMole's Telegram Tracker, we were able to reconstruct how Dark Storm's Telegram infrastructure developed from early 2025 through September 2026.

The first major disruption came in May 2025, when Telegram banned the group's owner account. GLITCH responded by announcing a replacement account and sharing a backup channel, asking existing members to move there. Additional channels appeared over the following months:

• Backup channel shared in May 2025: t.me/Darkstorm*****2
• Channel first observed in June 2025: t.me/darkstorm*****1
• Channel first observed in August 2025: t.me/darkstorm***f

By October 2025, this had become a recurring pattern. On 18 October, Dark Storm announced that its channel had been banned and directed followers to a replacement. Its presence on X faced similar disruptions. The account was reportedly banned at least three times in succession during the same period, with new handles announced through Telegram. By 27 October, the group had settled on another account and pinned the announcement for its followers.

• Main channel from October 2025: t.me/Darkstorm**k (Telegram ID: 3171169119)
• X account announced and pinned on 27 October 2025: x.com/dark******3

The same cycle continued throughout 2026. By March, a new main Telegram channel was active. On 5 May, Dark Storm announced another replacement channel alongside a new chat group. The September migration was particularly revealing because the replacement was not promoted by Dark Storm alone.

In early September, another Dark Storm channel was removed. This time, Team1914, one of the group's closest allies, circulated the announcement to its own followers, referring to Dark Storm as "our alliance Dark Storm Team" and sharing the replacement links. Within hours, Dark Storm had established another channel, which immediately informed members that the previous one had been banned.

The successive replacements included:

• Main channel by March 2026: t.me/Dark**Storm**** (Telegram ID: 3576990196)
• Created on 5 May 2026: t.me/Darkstorm****2 (Telegram ID: 3908675424)
• Chat group established in May 2026: t.me/darkst***s (Telegram ID: 3900953888)
• Created on 7 September 2026 and identified as the current main channel in the investigation: t.me/darkst****9 (Telegram ID: 4473764827)

Reconstructing the Channel Network

The Telegram Tracker results allowed us to consolidate the group's known channels and chat groups into a single timeline. Rather than treating each replacement as an isolated account, we used the recurring names, announcements, account references, and cross-posted links to map their relationship with the wider Dark Storm presence.

Channel / Chat	Telegram ID	Role	First observed
t.me/darkstorm*****t	2569741321	Dark Storm chat	May 2025
t.me/Darkstorm*****2	–	Backup channel	May 2025
t.me/darkstorm*****1	–	Channel	June 2025
t.me/darkstorm*****f	–	Channel	August 2025
t.me/Darkstorm*****k	3171169119	Main channel	October 2025
t.me/darkstorm*****2	3046079531	Chat group	November 2025
t.me/darkstorm*****7	–	Backup channel	November 2025
t.me/Darkstorm*****d	–	Channel	December 2025
t.me/Darkstorm*****3	–	Backup channel	December 2025
t.me/DARKSTORM*****E	2738650209	Update channel	February 2026
t.me/Storm*********s	3564004834	Services channel	February 2026
t.me/Dark**Storm***m	3576990196	Main channel	March 2026
t.me/Darkstorm*****2	3908675424	Main channel	May 2026
t.me/darkstorm*****s	3900953888	Chat group	May 2026
t.me/darkstorm*****9	4473764827	Current main channel	September 2026

The group's presence on X showed a similar pattern. Several handles appeared in October 2025 alone, reflecting the repeated changes to its social media accounts:

• x.com/Darkstorm*****2
• x.com/Darkstorm*****s
• x.com/Darkstorm*****0
• x.com/darkteam******3

What stands out is that Dark Storm's continued presence does not depend on a single Telegram channel or social media account. The group maintains alternative channels, announces replacements through existing communities, and benefits from allied groups that help distribute new links when its own channels disappear.

The September 2026 migration involving Team1914 is particularly important in this regard. It shows that Dark Storm's recovery process can extend beyond its own network, with allied channels helping it maintain visibility and reconnect with followers.

With the group's communication infrastructure mapped out, the investigation moved to the activity taking place across these channels. Beyond maintaining its presence, what was Dark Storm actually claiming, offering, and coordinating?

Inside the Campaigns

Dark Storm's Telegram channels serve another important purpose beyond maintaining the group's online presence: they provide a running record of its claimed attacks.

Most posts follow a familiar format. A target website is listed alongside a red cross symbol, followed by a Check-Host link presented as proof that the website is unreachable. The posts usually end with hashtags such as #DARKSTORM, #DARKSTORMTEAM, and a campaign-specific tag like #OpGermany or #OpEstonia. Some claims also include the phrase "closed by geo", suggesting that the target may have restricted access based on the visitor's geographical location.

Reviewing these posts chronologically through StealthMole's Telegram Tracker revealed how the group's targeting developed over time. Its earlier activity focused heavily on popular online platforms, but gradually expanded into country-specific campaigns involving government institutions, financial organisations, transport infrastructure, and other critical services.

Late 2025: Platform Attacks and the Canada Campaign

The main channel active from October 2025 initially showed a strong focus on high-profile online platforms. Within its first few weeks, Dark Storm claimed attacks against Reddit, Ancestry, Netflix, the Amino app, and even the cybercrime forum DarkForums.

• t.me/Darkstorm*****k (Telegram ID: 3171169119)

On 24 October 2025, the group added SpaceX to its list of targets. It later reposted a TechNadu article covering the claim, suggesting that media attention was also an important part of how Dark Storm presented its operations.

The same period marked the beginning of a more sustained national campaign under #OpCanada. Over several days, the group published claims involving a Canadian national security and intelligence portal, regional airports, public transport services, taxi companies, and the Federation of Canadian Municipalities.

By November, the targeting had expanded across several countries. Posts referenced Finland's Ministry of Defence and defence company Patria, Israeli government websites, Italian airports, Ukrainian ministries, Belgian intelligence and Antwerp airport, and Danish government services.

These campaigns showed that Dark Storm was no longer limiting its activity to recognisable online platforms. Government and public infrastructure had become a regular part of its target selection.

Early 2026: European Targets and #OpAustria

By March 2026, Dark Storm was publishing claims involving Finland's central bank and several Danish airports under the broader campaign tags #OpEurope and #OpAsia.

The activity became more concentrated in May, when the group launched #OpAustria ahead of Austria hosting Eurovision 2026. Its newly established channel published claims involving the city and airport of Graz, BAWAG and Euram banks and others.

The group also shared an Austrian news article discussing rising cyberattacks around the Eurovision contest, connecting its own claims to the wider attention surrounding the event.

• t.me/Dark**Storm**m (Telegram ID: 3576990196)
• t.me/Darkstorm****2 (Telegram ID: 3908675424)

Austria was part of a much wider targeting pattern during this period. Other posts involved Ukrainian cities and defence enterprises, Israeli government ministries and banks, UK energy and drone companies, and South Korean government services, including the Ministry of Education and e-government portals.

One particularly notable claim concerned London Gatwick Airport. Dark Storm stated that the airport had been "down for like 1-3 hours", presenting the alleged disruption as a significant achievement.

Over the following months, the group continued adding targets across Europe and the United States. These included Luxembourg's national railway and government ministries, Polish defence companies and the Warsaw Stock Exchange, as well as US Federal Student Aid portals.

September–November 2026: The Expanding #Op Campaigns

The channel created in September 2026 became the most active source of campaign claims identified during this investigation.

• t.me/darkstor******9 (Telegram ID: 4473764827)

From its first week, the channel began publishing a series of country-specific campaigns. Each followed the same naming convention, with an operation hashtag identifying the country and accompanying posts listing the alleged targets.

The campaigns covered Estonia, Germany, Poland, Romania, the Czech Republic, Italy, and France. The targets included government ministries, national portals, defence manufacturers, airports, transport services, financial institutions, and major technology companies.

The German campaign was particularly broad, with claims involving the Ministries of Justice and Defence, the Federal Foreign Office, regional transport services, city portals, federal courts, and the Federal Criminal Police Office (BKA). The French campaign similarly extended beyond government websites to include energy company EDF, OVHcloud, and telecom operator La Poste Mobile.

Two campaigns in October stood out because they moved beyond the group's predominantly European targeting.

Under #OpSaudiArabia, Dark Storm claimed attacks against Saudi ministries, three international airports, and Bank Al-Bilad. The campaign was introduced with the phrase "support for Yemen", providing an explicit political message behind the targeting.

A few days later, the group published claims involving North Korean government and state media websites, including the national portal Naenara and the Pyongyang Times.

Alongside these national campaigns, Dark Storm continued targeting well-known online platforms. Its posts included claims involving LinkedIn, the Internet Archive, 4chan, DeviantArt, Pixiv, OnlyFans, and Archive of Our Own. US-based targets also appeared, including the New York Police Department and the Treasury's Electronic Federal Tax Payment System (EFTPS). The #OpUSA campaign also included Robinhood.

Campaign Overview

The following table consolidates the major campaigns identified across the group's Telegram channels during the investigation.

Campaign	Period	Example targets	Source channel
Platform claims	Oct 2025–Nov 2026	Reddit, Netflix, SpaceX, LinkedIn, 4chan, Internet Archive	All channels
#OpCanada	Oct 2025	Intelligence portal, regional airports, municipalities	Darkstorm****k
#OpEurope / #OpAsia	Mar 2026	Bank of Finland, Danish airports	Dark*Storm***m
#OpAustria	May 2026	Graz airport, BAWAG, Vienna Stock Exchange, power grid	Darkstorm****2
#OpUkraine	May–Oct 2026	City portals, Kyiv airport, defence plants, Parliament	Darkstorm***2, darkstorm****9
#OpUnitedKingdom	May 2026	Gatwick Airport, energy and drone companies	Darkstorm***2
#OpLuxembourg	Jun 2026	National railway, Interior and Digitalisation ministries	Darkstorm***2
#OpEstonia	Sep 2026	State portal, Ministry of Finance, Parliament	darkstorm***9
#OpGermany	Sep–Nov 2026	Ministries, BKA, federal courts, transport	darkstorm***9
#OpPoland	Sep 2026	Defence manufacturers, county administrations	darkstorm***9
#OpRomania	Sep 2026	Justice, Education, Health ministries	darkstorm***9
#OpCzechRepublic	Oct 2026	Police, Václav Havel Airport, government	darkstorm***9
#OpItaly	Sep–Oct 2026	Bank of Italy, ports, Ministry of Defence	darkstorm***9
#OpFrance	Oct–Nov 2026	Ministries, EDF, OVHcloud, La Poste Mobile	darkstorm***9
#OpSaudiArabia	Oct 2026	Ministries, airports, Bank AlBilad	darkstorm***9
North Korea	Oct 2026	Naenara portal, state media	darkstorm***9
#OpUSA	Oct 2026	NYPD, EFTPS, Robinhood	darkstorm***9

Assessing the Attack Claims

The volume and geographical spread of Dark Storm's claims are considerable. However, the evidence attached to these posts does not always establish the impact the group describes.

Dark Storm frequently uses Check-Host reports to demonstrate that a target is unreachable. These reports provide a snapshot of website availability from a limited number of probes. They do not independently establish whether a DDoS attack took place, how long an outage lasted, or whether the website was inaccessible for an unrelated reason.

The group's own use of the phrase "closed by geo" makes this distinction particularly important. A website restricting access based on geographical location should not automatically be treated as evidence of a successful attack.

There is also a precedent for overstating impact. During the widely publicised X incident in March 2025, the Check-Host screenshot shared by Dark Storm as proof showed a single X profile being targeted rather than demonstrating that the entire platform was unavailable.

Another pattern emerged when comparing Dark Storm's posts with announcements from other hacktivist groups. Several targets, including Luxembourg's national railway, the Corsica Linea maritime training center, and the BKA portal, appeared in Dark Storm's claims only days after NoName057(16) had published claims involving the same targets.

The timing raises questions about whether Dark Storm participated in the same operations or simply checked and republished targets already circulating within the wider hacktivist ecosystem. The Telegram posts alone are not enough to establish which explanation is correct.

The campaigns show a group that places considerable importance on visibility. Its targeting spans government institutions, financial organisations, transport services, and internationally recognised online platforms. The country-specific hashtags also give its activity the appearance of organised campaigns, although the available evidence does not establish the actual scale or impact of every claimed attack.

However, the group's activity is not limited to public attack announcements. Dark Storm also advertises DDoS services to paying customers, introducing a commercial side to its operations that deserves separate examination.

Hacktivism as a Storefront

Dark Storm's Telegram channels are not just used to publish attack claims. They also serve as a marketplace for the group's services.

Across the channels examined, advertisements appear regularly alongside operational announcements. The most frequently reposted advertisement is a fixed DDoS price list that has remained largely unchanged since at least October 2025.

Service	Advertised price
DDoS – 3 hours	$20
DDoS – 8 hours	$50
DDoS – 1 day	$100
DDoS – 1 week	$350
DDoS – 1 month	$600
Website database dumping	From $50

Payments are accepted exclusively in cryptocurrency, with potential buyers directed to GLITCH's sales account. The price list is usually accompanied by a short message inviting customers to make contact. Occasionally, the group introduces promotional offers to attract buyers, including a 50% discount available until the end of May 2026 and an eight-hour DDoS service advertised for $25 in late October 2026.

The sales contact has also changed over time, although the underlying Telegram accounts provide continuity:

• @MRHEL****1 – Used until early 2026.
• @glitch****1 – Used between May and July 2026.
• @MRHEL*****2 – Used from July 2026 onwards.

The last two usernames belong to the same Telegram user ID, 8797265807, previously identified as GLITCH's sales account.

The pricing advertisements were not the only indication of commercial activity. In June 2026, Dark Storm pinned a broader service menu presenting itself as a team available for hire. Alongside DDoS attacks priced according to target size, the group advertised access to Instagram, Facebook, LinkedIn, X, and Telegram accounts, with prices starting at $250. Website database dumps were listed from $300.

From Attack Claims to Direct Payment Demands

The commercial side of Dark Storm's activity was not limited to advertising services in advance. In at least one instance, GLITCH directly connected an ongoing attack claim to a payment demand.

On 19 October 2025, he published a message stating that the DDoS activity against the Amino social app would stop if the company paid $5,000 in cryptocurrency. He followed this with a warning that anyone contacting him about Amino would be blocked.

A formal attack claim against Amino appeared on 22 October 2025, and the group returned to the same target in October 2026.

The sequence is significant because it shows GLITCH publicly using an alleged attack as leverage for a financial demand. This goes beyond the group's usual service advertisements and demonstrates how its hacktivist activity could also be used for direct monetisation.

A Broader Catalogue of Services

Over time, the group's advertisements expanded beyond DDoS attacks and website database dumping. Posts collected from its channels included offers involving:

• Payment card data: An advertisement offering 100 credit cards at a low price in November 2025.
• Hacking and information gathering: Services advertised using the wording "DD0S, DOX, H4CK database of site" in November 2025.
• Surveillance access: Offers involving access to CCTV cameras in Germany and the United States in October 2026.
• Advertising placements: Paid promotional slots on Dark Storm's Telegram channels, with enquiries directed to @MRHEL*****2.
• Custom targets: A standing invitation for potential customers to "send target" directly to the sales account.

These advertisements suggest that Dark Storm was attempting to position itself as more than a group conducting politically motivated DDoS campaigns. Its channels also promoted a wider range of services and access that appealed to customers interested in different forms of cybercrime.

Friends in Loud Places

Dark Storm's Telegram activity shows that the group operates within a wider hacktivist network. Some relationships involve mutual promotion and joint attack claims, while others are based on shared campaign messaging or the redistribution of each other's content. The strongest connections identified during this investigation were with Team1914 and NoName057(16), although the nature of these relationships differs.

Team1914 and the Disrupt0r Alliance

The clearest two-way relationship was with Team1914*******l.

It first became visible in September 2026, when Team1914 began tagging #DarkStormTeam in its attack claims under a shared banner called Disrupt0r. When Dark Storm lost its Telegram channel that month, Team1914 announced that its alliance partner had been banned and circulated replacement links. Dark Storm subsequently returned the favour by sharing Team1914's backup channel links.

The relationship was also reflected in their attack claims. On 2 October 2026, Dark Storm claimed that it had taken Israel's Mossad website offline in collaboration with Team1914 and wiped. Team1914 published the same claim minutes later under the banner "DARKSTORM x TEAM_1914 x wiped".

Another indication of their overlap appeared that day, when Team1914 published claims involving CCTV systems in Japan, Germany, the Netherlands, and Italy, tagging them with #DarkStormTeam alongside #NoName057(16), #Disrupt0r, and RBL Leviathan Ghost. Less than a day later, Dark Storm began advertising access to CCTV cameras in Germany and the United States. The timing suggests a possible connection between the activity, but the available posts do not establish whether the groups shared access or were simply using the same branding.

NoName057(16): An Amplification Relationship

Dark Storm's connection with NoName057(16) appears different. Rather than a clearly declared alliance, the evidence points to a pattern of repeated amplification and alignment with the group's campaigns.

Since at least May 2026, Dark Storm's channels have regularly forwarded posts from NoName057(16)'s Russian and English-language channels. Dark Storm also adopted campaign hashtags associated with the group, including #NONAME057, #FuckEastwood, and #TimeOfRetribution.

This activity continued when NoName057(16)'s channels and DDoSia group were banned in October 2026. Dark Storm relayed the group's contact bot and replacement channel link within a day. It also forwarded the announcement of NoName057(16)'s Tor portal approximately three and a half hours after its launch on 26 October.

The relevant sources identified through Telegram Tracker were:

• Russian-language channel - Telegram ID: 3087552512
• English-language channel, "NNM057(16) eng vers" – Telegram ID: 3869927851
• Tor portal – nnmo57***********************************jnid.onion

GLITCH's appearance in the DDoSia Project chat provides additional context, although it does not independently establish a formal operational relationship with NoName057(16). Overall, Dark Storm's repeated promotion of the group's channels and campaigns suggests close alignment and an active role in amplifying its activity. The precise nature of that relationship remains unclear and is examined further in the separate NoName057(16) report.

Other Declared Alliances and Connections

Several other groups publicly announced relationships with Dark Storm. These were mostly identified through announcements forwarded to Dark Storm's own channels:

• ZagNet: On 31 October 2025, announced that it had officially entered an alliance with Dark Storm and would work with the group.
• OverFlame: On 2 November 2025, announced its "unification" with Dark Storm in a Russian-language post.
• PalachPro: On 15 November 2025, Dark Storm itself announced an alliance and shared the group's channel.
• CyberTroll Team: On 9 October 2026, published a "CyberTroll x DarkStorm" announcement. Dark Storm subsequently reposted its claims involving Rome, France's ANSSI, and several Swedish cities.

Other names appeared more narrowly in the collected data. wiped was named alongside Team1914 in the Mossad claim, while BNCT1360 and RBL Leviathan Ghost appeared in Team1914's joint hashtags. These references establish campaign-level overlap, but not necessarily direct relationships with Dark Storm.

The relationships identified here vary considerably in strength. Team1914 has the clearest evidence of reciprocal cooperation, while NoName057(16) is repeatedly amplified by Dark Storm. Other groups appear through public alliance announcements, joint campaign references, or advertising exchanges. This distinction matters: appearing alongside Dark Storm in a post does not automatically make a group an operational partner.

Conclusion

When Dark Storm first attracted public attention, it was widely described as a pro-Palestinian hacktivist group. Its early threats focused on Israel, NATO members, and countries perceived as supporting Israel. This was also the image that shaped much of the coverage following the 2025 X outage.

By October 2026, however, the group's own Telegram presence was presenting a different identity. The link preview for its current channel described Dark Storm as a "Pro Russian group since 2023" and linked to its Wikipedia page.

This positioning is reflected in its recent activity. Dark Storm regularly forwards NoName057(16) material targeting European support for Ukraine, including posts about German military aid and NoName's "Tribunal" campaign against European politicians. It has also adopted NoName's campaign hashtags, while its declared ally OverFlame used explicitly pro-Russian messaging when announcing its partnership with Dark Storm.

Yet the group's activity does not fit neatly into a single political alignment. In September 2026, Dark Storm published a post featuring the Yemeni flag with the hashtag #YEMEN. The following month, it launched #OpSaudiArabia with the stated message "support for Yemen", targeting Saudi institutions and directing an insult at Crown Prince Mohammed bin Salman. Israeli targets have also continued to appear in its attack claims.

The group also appears conscious of its public reputation. In October 2026, it reposted a March 2025 post by a security researcher who had claimed to identify the individuals behind the X outage. Dark Storm labelled the repost a "throwback" and mocked the researcher's attribution.

The available evidence points less to a clearly documented change in ideology than to a shift in the groups and causes Dark Storm chooses to associate itself with. Its recent messaging shows stronger alignment with the pro-Russian hacktivist ecosystem, particularly NoName057(16), while its activity continues to draw on other geopolitical grievances. Whether this reflects a genuine ideological shift or a strategic effort to expand its alliances and audience cannot be established from the Telegram activity alone.

Editorial Note

Dark web investigations rarely provide a complete or definitive picture. Public claims can be exaggerated, identities difficult to verify, and relationships open to more than one interpretation. This case demonstrates how StealthMole's historical Telegram data and cross-account tracking can help investigators follow activity across channel bans, account changes, and shifting alliances, while keeping those uncertainties visible rather than treating every connection as proof.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com

n0n: Leak Site, Infrastructure and Victims of a New Extortion Operation

n0n appeared on the dark web in September 2026. Within five weeks, its leak site had listed more than a hundred organisations, and a campaign targeting ports, shipping companies and logistics providers brought the group into wider public attention.

The scale of the listings is striking, but the numbers alone do not explain how the operation works or how successful it has been. Its own records tell a more complicated story. Victims appear under anonymous placeholders before being named, ransom demands can change substantially within days, and sample files attached to seemingly unrelated organisations contain overlaps that raise questions about where the data originated.

By following n0n's leak site, its RSS feed, connected infrastructure and payment records through StealthMole, this investigation examines how the group built its public presence, what its maritime campaign reveals about its possible access to victim data, and whether its claims of scale are reflected in the evidence available.

A New Name on the Dark Web

n0n's leak site provided the first look at how the group presented itself. Its approach was straightforward: list an organisation, set a deadline and threaten to publish its data if the victim failed to pay.

• nongze***************************************snad.onion

The next question was when the operation first surfaced and how quickly it began naming victims. Searching for n0n in StealthMole's Telegram Tracker brought up an early post from the threat intelligence channel DARKFEED, which identified the group as a new threat actor on 18 September 2026. About an hour later, Ransomfeed News reported Venezuelan internet provider Inter as the group's first publicly named victim, with the post timestamped 17:51 GMT.

The two reports place n0n's public emergence and its first reported victim within a short period. They provide an early reference point for tracking the operation, although they do not establish when the group began operating privately or whether Inter was its first actual target.

The leak site also reveals how n0n wants victims to experience the extortion process. It runs without JavaScript under the tagline “no js | no mercy” and separates listings into four tabs: Pending, Exposed, Leaked and Honor. Each listing carries a countdown, and the site states that data will be published when the timer expires without payment. Victims are instructed to use a personal key from their ransom note to enter a private negotiation room.

This arrangement connects the public pressure campaign to a private negotiation process. The listing makes the threat visible, while the countdown gives it a deadline. The private key provides a separate route for the victim to engage with the group. These are the procedures n0n describes on its site; the available evidence does not establish whether every victim was handled in exactly this way.

There is also a detail that matters when tracking the group across different sources. A notice in the site's footer specifies the preferred spelling, “n0n”, with a zero between two lowercase n's, and lists alternative spellings that visitors should avoid. The notice first appeared in the group's RSS feed on 12 October.

That clarification provides a useful reference when searching for the group across Telegram, leak records and other indexed sources. It also highlights a practical issue in actor tracking: a search that relies on one spelling may not capture every relevant reference, while similar names can introduce unrelated activity.

A snapshot dated 27 October showed three figures in the site's footer:

• 105 organisations listed
• 2,300,186 site visits
• 307,163 data downloads

The three figures should not be treated as equally reliable. The visit and download counters are controlled by the group and cannot be independently verified from the available evidence. The organisation count, however, matches the listings visible on the site. It provides a more defensible measure of the group's published victim list, although it does not independently confirm 105 successful intrusions.

From Onion to Clearnet

The leak site was not the only location used to make n0n's claimed stolen data available. Its victim listings promised downloadable archives in ZIP and torrent formats for organisations that failed to pay. Following the links from the onion site in StealthMole's Dark Web Tracker led to a separate clearnet domain: n0n.**.

Nine torrent files linked directly from the leak site had been collected on 21 September 2026:

• https://n0n.**/t/uft.torrent
• https://n0n.**/t/vn-betting.torrent
• https://n0n.**/t/astrazeneca-tr.torrent
• https://n0n.**/t/minedu-ar.torrent
• https://n0n.**/t/stokr.torrent
• https://n0n.**/t/paypal-transcom.torrent
• https://n0n.**/t/argentem-creek.torrent
• https://n0n.**/t/konnatus.torrent
• https://n0n.**/t/beliteacher.torrent

The filenames correspond to nine organisations already named on n0n's leak site: the United Federation of Teachers, a Vietnamese betting operator, AstraZeneca Türkiye, Argentina's Ministry of Education, STOKR, Transcom's PayPal support operation, Argentem Creek Partners, Konnatus and BeLi Teacher.

The important detail is that these were not simply files found on a separate website with a similar name. The torrent URLs were linked directly from the group's own victim listings. This establishes a clear connection between the onion site and the clearnet domain, and shows that the latter was being used to distribute archives associated with the listed victims.

To establish whether n0n.** appeared elsewhere in the available intelligence, the domain was further investigated in StealthMole's Dark Web Tracker. The search returned 13 Tor URLs referencing it. All belonged to n0n's leak site, including the homepage and listing pages for the early victims. No other dark web page, Telegram channel or leak record referenced the domain in the results examined.

The Group's Own Record

The leak site's footer links to an RSS feed that provides a more useful record of n0n's activity than a single snapshot of the site. StealthMole’s captured snapshots of the leak site showed active entries, their status and their deadlines. Because the captures preserve earlier versions of the feed, they make it possible to compare how n0n's public claims changed over time, including cases where a current listing no longer reflects what appeared in an earlier snapshot.

• nongze******************************************snad.onion

The first capture, dated 21 September, already marked nine victims as “not paid, data published”. Their deadlines ranged from 19 September to 21 September. This places the first claimed publications within days of the group's initial appearance in the available reporting.

The feed becomes particularly useful in early October, when n0n began adding entries under anonymous labels such as “Company #74”, accompanied by a brief description of the organisation's sector and location. As deadlines approached, some of these entries reappeared under the organisation's actual name.

Several examples illustrate the pattern:

Placeholder	Description in Feed	Later Named As
Company #22	Neurology practice, New South Wales	Hunter Neurology
Company #24	Smart building and surveillance integrator, California	Interior Technologies
Company #70	FX liquidity and trading technology, Netherlands	Solid Trading B.V.
Company #74	Semiconductor manufacturing, California	SMIC US Company
Company #76	Fintech payments, US	Finzly Corp

This pattern has two implications for interpreting the group's activity.

First, a placeholder and its later named version may represent one organisation at two points in the publication process, rather than two separate victims. Counting every record independently would therefore inflate the apparent size of the operation.

Second, the feed gives a view of how n0n stages its public disclosures. The anonymous entries preserve some information about a target while withholding its name; later updates make the identification public. The timing is consistent with a staged disclosure process, although the records do not establish why the group chose to anonymise particular victims or whether every placeholder was eventually named.

This distinction became clear when n0n was searched further in StealthMole's Ransomware Monitoring. The search returned 133 recorded victims associated with n0n, including duplicate records for organisations listed first as placeholders and later by name.

Who n0n Targets

The early victim list shows no clear concentration in a single sector. Between 18 September and early October, n0n named organisations ranging from internet and IT service providers to healthcare, finance, government and retail.

Among the early listings were:

• Inter, Venezuela's largest internet provider.
• Transcom WorldWide, through its PayPal customer support operation.
• AstraZeneca Türkiye.
• Argentina's Ministry of Education.
• The United Federation of Teachers in New York.
• Fanatics, the US sports merchandise company.
• Dediserve, a cloud hosting provider in the iomart group.
• FinSoft, an Uzbek retail software vendor.

Later listings included US healthcare practices, managed IT providers, a fintech payments vendor, a semiconductor firm's US arm, a dental laboratory, a hotel and a Korean IT services company.

The range of organisations suggests that n0n was not limiting its public campaign to one industry. However, the victim list alone cannot establish whether the group selected targets opportunistically, obtained access through a common third party, or acquired data from multiple unrelated sources.

The wording of some early listings is also worth examining. Several go beyond threatening to release stolen files and claim extensive disruption to the victim's systems.

AstraZeneca Türkiye's listing states that “all sites are enforcing a total network blackout until settlement”. FinSoft and AFRICA-TECH are told that “all backups and shadow copies are encrypted or destroyed”. The Dediserve listing claims that all 46 servers at its Frankfurt site and their backups were removed.

These statements portray n0n as an operation capable of affecting entire victim environments, not merely obtaining and publishing documents. But the distinction between a group's claim and a verified incident is important here. The available evidence does not independently confirm the extent of the alleged disruption, encryption or destruction.

The Maritime Campaign

On 12 October 2026, n0n published 38 organisations from the port, shipping and logistics sector in a single batch. The listings covered 18 countries, with South Korea accounting for 12 organisations.

The timing is notable. Thirty-eight organisations across 18 countries appeared in a single short window, rather than being added gradually over several days. This establishes a coordinated publication event, although it does not by itself show that all the data was acquired at the same time or through the same means.

The listings also use a different format from n0n's earlier posts. Each specifies a fixed settlement amount in US dollars, provides a dedicated Bitcoin address and states that payment is verified automatically on the blockchain. Victims are offered a one-time alternative: pay 10% of the stated settlement to the same address and use the transaction ID to claim a private negotiation room.

Unlike the earlier listings, none of the maritime entries claims network disruption. The stated leverage is the data itself.

This difference matters because it changes what can be inferred from the group's own descriptions. The earlier posts presented n0n as having extensive control over some victims' systems. The maritime entries instead emphasised possession of data and the prospect of publication. The records do not establish whether this reflected a different acquisition method, a different type of access, or simply a different way of presenting the campaign.

The Ransom Demands Did Not Stay the Same

The initial ransom demands attracted considerable attention. Public reporting placed the total for the maritime batch at around USD 1.22 billion. Yet the 21 October leak-site snapshot gives a much lower combined figure of approximately USD 275.8 million.

The difference becomes clear when the RSS feed captures are compared. Between 12 and 16 October, n0n reduced the five largest demands while leaving the other 33 unchanged.

Listing	12 October demand (USD)	16 October demand (USD)
Ocean Network Express	400,000,000	25,000,000
Apical Group	320,000,000	25,000,000
ZPMC	160,000,000	18,000,000
Dongkuk Steel	100,000,000	10,000,000
T.S. Lines	56,000,000	10,000,000

Using the original figures, the 38 demands totaled USD 1,223.8 million. After the five reductions, the total fell to approximately USD 275.8 million.

The important point is not simply that the demands fell. The reductions were concentrated in five listings, while the other 33 remained unchanged. The resulting total was therefore driven heavily by a small number of exceptionally large demands.

The records establish that n0n changed its pricing within four days of publishing the batch. They do not explain why. The reductions could reflect a change in the group's negotiating position, an attempt to make the demands more realistic, or another motive, but none of these explanations can be established from the feed alone.

What can be said is that the original billion-dollar total was not a stable measure of the group's eventual demands. Any assessment of the campaign needs to account for when the figures were recorded rather than treating the first published amounts as the final position.

One Source, Many Victims?

The sample files attached to the 38 maritime listings raise a more substantial question: do they represent data taken independently from each named organisation, or could at least part of the batch have come from a common source?

Several filenames refer to the same family of maritime software, OPUS and ALLEGRO, across different organisations:

• Eurogate Tanger: 524900_[PNO+MGT+WebPortal] EGT_Release Note_Release_OPUS Terminal_20230707.docx
• NCT Kandla: 93101_RE KAP OPUS MGT is down URGENT00069.msg
• Korea Ferry: 436473_OPUS ADMIN_KFC STAFF.xlsx
• Portonave: 164167_sl-opus00060.txt
• CULines: 848346_UGL BL template on Allegro - 0807.xlsx
• Tsuneishi / Kambara Kisen: 658686_Allegro Seacast CSV June.2024-1.xlsx

The filenames are not the only point of overlap. Several samples read like correspondence between a software vendor and its customers, including release notes, a gap analysis report, enhancement requests and an urgent support email about a system outage. That is different from a collection made up exclusively of documents that clearly originate from each victim's internal systems.

The filenames also share a structured format. Each begins with a numeric ID, and many end with a five-digit counter. The same general pattern appears across listings associated with different organisations. One file appears under both April Asia and GlobalNet LCL.

These details raise the possibility that at least part of the batch came from a common archive or system rather than from 38 wholly separate collections of data. The repeated software references suggest a connection to the maritime technology ecosystem, while the filename structure and duplicate sample provide additional reasons to examine whether the files share a common origin.

That remains a hypothesis, not a confirmed explanation. Shared software does not, on its own, prove a shared breach, and the available filenames cannot establish how the files were obtained or whether all the organisations were affected in the same way.

There is, however, an external assessment that aligns with this interpretation. Maritime cybersecurity firm Cydome has publicly assessed that the batch likely originated from a single support archive linked to CyberLogitec, a South Korean maritime software vendor owned by EUSU Holdings. CyberLogitec develops the OPUS and ALLEGRO products referenced in the samples.

The relationship is worth noting because EUSU Logistics, which shares the EUSU name, is itself among the 38 listed organisations. Its attached samples include an infrastructure assessment and file server configuration.

The available evidence does not prove that CyberLogitec was the source, and CyberLogitec has not confirmed an incident. Nor does the shared EUSU name establish a connection between the data in the listings and the vendor or its owner. Nevertheless, the repeated OPUS and ALLEGRO references, common filename patterns, duplicate sample and vendor-style correspondence are consistent with Cydome's assessment that a common support archive may be involved.

By 21 October, the deadlines for all 38 maritime listings had expired. All were marked “NOT PAID — LEAKED”, with ZIP and torrent downloads attached. The group had therefore moved from threatening publication to claiming that the data was available, but the listing status alone does not independently verify the completeness or provenance of each archive.

Following the Payments

The ransom demands provide one measure of the scale n0n wanted to project. The Bitcoin addresses attached to each listing offer another way to examine the campaign: rather than relying on the group's stated settlement status, payments can be checked against the addresses it published. Each of the 38 maritime listings carried a dedicated Bitcoin address.

Victim	Country	Settlement (USD)	Bitcoin address
Tsuneishi / Kambara Kisen	Japan	28,000,000	bc1qx***************t49
Santos Brasil	Brazil	26,000,000	bc1q****************h2z
Ocean Network Express	Singapore	25,000,000	bc1q****************4x8
Apical Group	Singapore	25,000,000	bc1q***************hne
ZPMC	China	18,000,000	bc1q****************avt
EUSU Logistics	South Korea	14,000,000	bc1q3***************g98
Pusan Newport Company	South Korea	12,000,000	bc1q***************8asn
Polaris Shipping	South Korea	12,000,000	bc1q****************hue
Samudera	Indonesia	12,000,000	bc1q****************k9c
Dongkuk Steel	South Korea	10,000,000	bc1q****************5ml
T.S. Lines	Taiwan	10,000,000	bc1q****************03m
TTI Algeciras	Spain	10,000,000	bc1q****************fvr
Yusen Logistics Hong Kong	Hong Kong	8,000,000	bc1qp***************egm
BNCT (Busan New Container Terminal)	South Korea	8,000,000	bc1q****************l83
CULines	China	7,800,000	bc1q****************7f2
Eurogate Tanger	Morocco	6,000,000	bc1q****************lcy
Portonave	Brazil	5,800,000	bc1q****************myf
Nam Dinh Vu Port	Vietnam	5,000,000	bc1q****************827
Asyaport	Türkiye	4,800,000	bc1q****************a4e
NEOM Ports	Saudi Arabia	4,000,000	bc1q****************4ph
Dong-A Tanker	South Korea	3,200,000	bc1qh***************dv8
ILCS Pelindo	Indonesia	2,400,000	bc1q****************tkg
T2S	Brazil	2,400,000	bc1q****************e46
Camellia Line	Japan	2,000,000	bc1q****************4ug
HPC Hamburg Port Consulting	Germany	2,000,000	bc1q****************6ga
NCT Kandla	India	1,600,000	bc1q***************r9p
Superterminais	Brazil	1,600,000	bc1q***************pt8
BKH ICD	South Korea	1,200,000	bc1q****************5ra
GNCNet / DGT Busan	South Korea	1,200,000	bc1q****************g6p
Korea Ferry	South Korea	1,200,000	bc1q****************7vc
GCS Kuwait	Kuwait	1,000,000	bc1q****************c9s
April Asia	Indonesia	800,000	bc1q****************td6
GlobalNet LCL	Indonesia	800,000	bc1q****************mh3
MGNP	South Korea	800,000	bc1q****************m96
Premier Alliance	Netherlands	800,000	bc1q*****************xy
Samjoo Maritime	South Korea	600,000	bc1q****************05s
BMT IQ	United Kingdom	400,000	bc1q****************j0l
Saehan Marine	South Korea	400,000	bc1q****************usw

The address list gave a way to test whether the campaign had generated any visible payments. A review of public blockchain records as of 22 October 2026 found no transactions received by any of the 38 addresses. This includes the smaller 10% payments that n0n said would unlock a private negotiation room.

That result is significant when considered alongside the changing ransom demands. The group initially attached more than USD 1.2 billion in demands to the batch, later reduced the total to approximately USD 275.8 million, and marked the listings as leaked after their deadlines expired. Yet none of the published addresses had received an on-chain payment by the date checked.

This does not establish that no victim negotiated with n0n or that no payment could have been made through another route. It does establish that the 38 addresses published for this campaign showed no incoming transactions in the records reviewed. The settlement amounts should therefore be treated as demands, not money received.

The picture outside the maritime batch is different. The leak site's Honor tab lists ten anonymised organisations as having “honored their deadline”, with their data marked as destroyed between 5 and 20 October. All ten entries are anonymised. The first two, described as a US technology company and a Canadian financial services firm, were recorded as settled on 5 and 7 October.

These entries suggest that n0n claims to have reached settlements with other victims, but the site's statements are not independently verified payment records. Unlike the maritime listings, the Honor entries do not provide named Bitcoin addresses that can be matched to those outcomes.

One case in the historical RSS captures offers a possible link between a named victim and an anonymous entry. In the 12 October capture, Company #23, described as an architecture and design firm in Florida, was pending with a deadline of 14 October. By 16 October, the feed listed Trieschmann Dumala Architectural Group as “not paid, exposure passed”, with exactly the same deadline. In the 21 October snapshot, Trieschmann Dumala no longer appeared, while Company #23 was listed in the Honor tab with its data marked as destroyed on 18 October.

The matching deadline and description support the possibility that Company #23 and Trieschmann Dumala were the same organisation, later moved back into an anonymous entry after a settlement. The connection has not been confirmed, however, and the available records do not independently establish that a payment occurred.

The contrast is worth keeping in view: the maritime campaign's published wallets showed no incoming transactions, while n0n's own records claimed that ten other organisations had settled. One finding is based on the reviewed blockchain records; the other remains the group's account of its negotiations.

What the Group Says Comes Next

The 21 October snapshot of n0n's leak site included a banner under the heading “COMING SOON”. It announced a future publication involving:

• “more than 500 organizations”
• a “combined value almost 1 trillion USD”
• “the largest breach we have held to date”

No organisation names, sample files or download links accompanied the announcement.

The same banner stated that n0n would be “opening our affiliate doors”, inviting other hackers to apply and “become n0n as well”.

The proposed publication would represent a substantial increase on the 102 organisations listed in the 21 October snapshot. But at this stage, the announcement is a claim about future activity, not evidence that the group has obtained data from more than 500 organisations or that the combined value of the material approaches USD 1 trillion.

The maritime campaign offers a reason to be cautious about taking the headline figures at face value. Its original demands totalled more than USD 1.22 billion before being reduced to approximately USD 275.8 million within four days. That history does not prove the next announcement will be exaggerated, but it shows that figures published by the group can change substantially.

The affiliate announcement is also significant, although its implications remain uncertain. If implemented, it could extend the n0n name beyond the original operators by allowing other hackers to participate under the same brand. It is not yet clear whether this would involve a formal affiliate programme, shared infrastructure, revenue sharing or simply permission to use the name. None of those arrangements can be confirmed from the banner alone.

Conclusion

The evidence collected so far shows an operation that developed a visible leak-site presence quickly, used its own RSS feed to track changing victim listings, and connected its onion site to a clearnet domain hosting torrent files. The historical captures also reveal that the published victim count needs to be deduplicated: anonymous placeholders and later named entries can refer to the same organisation, while searches for the group's name can return records belonging to unrelated actors.

The maritime campaign is the most significant finding in this investigation, but not simply because it involved 38 organisations across 18 countries. The shared OPUS and ALLEGRO references, recurring filename structure, duplicate sample and vendor-style correspondence raise the possibility that at least part of the batch originated from a common data source. Cydome's assessment of a possible CyberLogitec-linked support archive is consistent with those observations, but the source has not been confirmed.

The payment records add another dimension. As of 22 October, none of the 38 Bitcoin addresses associated with the maritime campaign had received a transaction, despite the group's substantial published demands. Its Honor tab, meanwhile, claimed that ten other organisations had settled. Those claims remain unverified, and one apparent link between a named victim and an anonymised Honor entry is suggestive rather than conclusive.

The findings show why n0n's published numbers should not be used as a direct measure of successful attacks or financial returns. The group has demonstrated a consistent public process for listing organisations, setting deadlines and publishing data it claims to hold. However, the number of listings, the origin of the data, the extent of compromise and the money actually received are separate questions. The available evidence answers some of them more clearly than others.

The announced plan to publish data relating to more than 500 organisations and open the operation to affiliates could mark a new phase, but it remains untested. Whether n0n can turn that stated ambition into a larger and more effective operation will depend on what appears next, not on the size of the figures in its own announcement.

Editorial Note

Dark web investigations rarely provide a complete picture. Threat actors control their own publications, change claims and listings over time, and have an incentive to present their operations as larger or more successful than the available evidence may support. In this case, StealthMole's historical captures, Dark Web Tracker, Telegram Tracker and Ransomware Monitoring helped connect the group's infrastructure, reconstruct changes to its victim records and compare its public claims with observable evidence. Those findings make the operation easier to assess, but questions around the source of the maritime data, the extent of individual compromises and the group's actual financial returns remain open.

To access the unmasked report or full details, please reach out to us separately.

Contact us: support@stealthmole.com