Investigation Traces Dark Storm Team’s Operations, DDoS Services and Alliances
Summary
A Telegram-based investigation maps Dark Storm Team’s account and channel changes, claimed attacks, DDoS services and group relationships. It cautions that availability checks do not prove attacks and that some affiliations remain unclear.
Key points
- Researchers used Telegram activity, account references and cross-posted links to reconstruct Dark Storm’s channel migrations and identify accounts associated with the GLITCH persona.
- Dark Storm published DDoS claims against government, transport, financial and other organizations. Check-Host availability results do not establish that a DDoS attack caused an outage.
- The group advertised DDoS services, database dumping and other offerings for payment in cryptocurrency; GLITCH also publicly demanded $5,000 to stop an alleged Amino attack.
- Evidence indicates reciprocal promotion and cooperation with Team1914, while Dark Storm repeatedly amplified NoName057(16). The investigation says it cannot establish a formal operational relationship with NoName057(16).
- A rival group’s claim about GLITCH’s real-world identity was not independently corroborated, and the investigation identified inconsistencies in the supporting information.
- The investigation describes stronger recent alignment with pro-Russian hacktivist messaging but says Telegram activity alone cannot establish whether this reflects an ideological shift or a strategic choice.
Article Details
- Attack Vectors
- Dark Storm Team claimed DDoS attacks against government, financial, transportation, defense, and online-platform targets; the article says its Check-Host screenshots do not independently prove an attack or its impact.
- The group advertised DDoS-for-hire services through Telegram, including an offer to stop alleged DDoS activity against Amino in exchange for $5,000 in cryptocurrency.
- Dark Storm advertised website database dumping, access to social-media accounts, payment-card data, and CCTV access; the article does not establish that these advertised services were carried out.
- The group used Telegram channels and accounts to publish attack claims, promote services, and circulate replacement links after channels or accounts were banned.
- Defensive Notes
- Treat attack claims and Check-Host screenshots as unverified: they do not independently establish that a DDoS attack occurred, its duration, or its impact.
- Do not treat a website's unavailability as proof of an attack without considering other explanations, including geographic access restrictions.
MITRE ATT&CK
T1498 · Network Denial of ServiceDark Storm Team claimed DDoS attacks against websites and public-facing services and advertised DDoS attacks for hire; the article does not verify the impact of its claims.T1585.001 · Social Media AccountsThe group maintained and announced replacement social-media accounts, including X accounts, after reported bans.
Threat Actors
Dark Storm TeamThe group claimed DDoS attacks against numerous targets and advertised DDoS and other services. The article cautions that its posts and Check-Host screenshots do not establish that every claimed attack occurred or caused the stated impact.GLITCHThe article identifies GLITCH as the persona presented as Dark Storm Team's owner and sales contact. GLITCH advertised services and demanded $5,000 in cryptocurrency to stop alleged DDoS activity against Amino; the persona's real-world identity was not independently verified.NoName057(16)The article describes NoName057(16) volunteers as operating the DDoSia client and reports that Dark Storm repeatedly amplified the group's posts and campaigns. It does not establish that Dark Storm participated in the same operations.Team1914The article describes Team1914 as a close ally of Dark Storm and reports that both groups published a claim of a joint attack against Mossad. The claim is not independently verified.
Products
AminoWithin its first few weeks, Dark Storm claimed attacks against Reddit, Ancestry, Netflix, the Amino app, and even the cybercrime forum DarkForums.Telegramloosely connected collectives has gradually developed into a network of groups that maintain multiple Telegram channels, announce alliances, cross-promote attack claims, and use major geopolitical events to gainXFirst observed in late 2023, it gained widespread attention in March 2025 after claiming responsibility for a large-scale outage affecting X (formerly Twitter).
Tools
Dark Web TrackerA pivot using the associated landline in StealthMole's Dark Web Tracker returned only unrelated database dumps in which the same digits appeared as record values.DDoSiaA more revealing connection emerged on 21 October 2026, when GLITCH appeared in a Telegram chat called DDoSia Project.Telegram TrackerUsing StealthMole's Telegram Tracker, we pivoted from GLITCH's known user nodes to identify the accounts associated with the persona.
Countries
AustriaThe activity became more concentrated in May, when the group launched #OpAustria ahead of Austria hosting Eurovision 2026.CanadaLate 2025: Platform Attacks and the Canada CampaignFranceThe campaigns covered Estonia, Germany, Poland, Romania, the Czech Republic, Italy, and France.GermanyThe campaigns covered Estonia, Germany, Poland, Romania, the Czech Republic, Italy, and France.IsraelOn 2 October 2026, Dark Storm claimed that it had taken Israel's Mossad website offline in collaboration with Team1914 and wiped.UkraineDark Storm regularly forwards NoName057(16) material targeting European support for Ukraine, including posts about German military aid and NoName's "Tribunal" campaign against European politicians.United StatesGLITCH wrote that he needed help "from putin to use nuclear on usa, europe".
Industries
Critical infrastructureHe announced new channels, published attack claims, issued threats against critical infrastructure, and personally handled purchase enquiries.EnergyOther posts involved Ukrainian cities and defence enterprises, Israeli government ministries and banks, UK energy and drone companies, and South Korean government services, including the Ministry of Education and