{
  "family": "stormattack",
  "sample_count": 62,
  "category": "trojan",
  "description": "StormAttack (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/StormAttack and Trojan:Win32/StormAttack!MTB) is a Windows trojan downloader and distributed denial-of-service bot component active since 2017. Borrowing architectural motifs and naming conventions from historic storm botnet families, StormAttack infiltrates endpoints primarily through trojanized software activators, cracked games, and malicious email links. Upon execution, the malware establishes persistence through registry autostart keys under Windows CurrentVersion\\Run, disables security notification popups, and initiates encrypted C2 communications. StormAttack receives operator commands to stage secondary malware threats—such as cryptocurrency miners and infostealers—and participates in coordinated packet flood attacks against targeted web services.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/StormAttack",
    "Trojan:Win32/StormAttack!MTB",
    "StormAttack",
    "Win32/StormAttack"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/StormAttack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "StormAttack is a Windows trojan downloader and botnet component capable of staging secondary malware and launching DDoS attacks."
      }
    },
    {
      "@type": "Question",
      "name": "How does StormAttack compromise computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through cracked software activators, trojanized game packages, and phishing email links."
      }
    },
    {
      "@type": "Question",
      "name": "What actions can StormAttack carry out on an infected system?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It downloads secondary payloads like miners, suppresses security warnings, and launches network packet floods."
      }
    },
    {
      "@type": "Question",
      "name": "How does StormAttack maintain persistence across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes autostart entries to the Windows CurrentVersion\\Run registry key."
      }
    },
    {
      "@type": "Question",
      "name": "How do you disinfect a machine from StormAttack?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quarantine the file with Microsoft Defender, delete suspicious registry keys, and run an offline antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1498",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1566.001",
      "name": "Phishing: Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy",
      "tactic": "Command and Control"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint immediately to halt the massive outbound spam campaigns or its participation in a DDoS attack.",
    "Enforce strict egress firewall rules, particularly focusing on blocking the unauthorized UDP ports utilized by the P2P Overnet communication protocol.",
    "Capture a forensic memory image to analyze the injected threads within `services.exe` and identify the peer nodes it is communicating with.",
    "Assume total endpoint compromise; due to its aggressive rootkit components, a clean OS rebuild is the only guaranteed remediation."
  ],
  "what_to_avoid": [
    "Do not ignore the infection as a 'minor spam issue'; the botnet controllers have full remote code execution capabilities on the endpoint.",
    "Avoid relying solely on file deletion; the rootkit components actively hide files and registry keys from standard OS APIs."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Botnet Operations & Payload Staging",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Software Activators",
    "Cracked Game Packages",
    "Phishing Email Links"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Payload Downloading",
    "DDoS Packet Flooding",
    "Registry Autostart Persistence",
    "Security Notification Suppression",
    "Encrypted C2 Beaconing"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Encrypted TCP/HTTP beacons reporting host GUIDs to remote C2 IP endpoints",
      "High-volume UDP/TCP flood traffic during DDoS commands"
    ],
    "evasion_techniques": [
      "Dynamic runtime unpacking in memory",
      "Masquerading as Windows helper utilities"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\StormAttackClient",
      "%AppData%\\StormAttack\\storm_svc.exe"
    ]
  },
  "impact": {
    "confidentiality": "Medium",
    "integrity": "High",
    "availability": "High",
    "scope": "Unauthorized secondary software installation, bandwidth consumption, botnet recruitment"
  },
  "lineage": {
    "derived_from": [
      "Win32 DDoS & Downloader Botnets"
    ],
    "variants": [
      "StormAttack.A",
      "StormAttack.MTB"
    ]
  },
  "iocs": {
    "file_hashes": [
      "2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c",
      "3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d"
    ],
    "delivery": [
      "crack_setup.exe",
      "game_activator.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\StormService",
      "%Temp%\\stormattack.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/StormAttack",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/StormAttack"
    },
    {
      "name": "Malwarebytes Labs Threat Encyclopedia - Trojan.StormAttack",
      "url": "https://www.malwarebytes.com"
    }
  ]
}