Dark Storm Team Offers DDoS Attacks, Database Dumps, and Stolen Access ...

Dark Storm Team uses Telegram as both a hacktivist broadcasting network and a cybercrime storefront, advertising distributed denial-of-service attacks, database dumps, compromised accounts, and surveillance access.

A StealthMole investigation described in the supplied material traces an operation combining politically framed disruption claims with commercial services, cryptocurrency payments, and repeated channel migrations.

First observed in late 2023, the group attracted international attention after claiming responsibility for outages affecting X in March 2025.

However, contemporaneous reporting noted that X had not confirmed Dark Storm’s involvement, an important distinction between public attribution claims and independently established responsibility.

Telegram account changes did not erase that continuity: researchers linked replacement profiles through public announcements, backup-account declarations, and persistent numerical identifiers.

One sales account retained Telegram user ID 8797265807 despite changing usernames during 2026.

That continuity illustrates why tracking immutable account identifiers can provide stronger attribution evidence than relying on display names or handles.

Researchers also examined a rival group’s purported identification of GLITCH but found no independently corroborated connection between the named individual and the operator’s Telegram accounts.

The supplied investigation therefore does not establish GLITCH’s real-world identity.

Stealthmole investigation identified , GLITCH as Dark Storm’s recurring owner persona, spokesperson, and sales .

Dark Storm Team Operations

On 7 October 2025, an Indian hacktivist channel published a post titled “Owner of TEAM DARK STORM”. The post was subsequently forwarded into the Bhartiya Hunters chat.

Those differences reflect advertised offers rather than verified transactions or demonstrated capabilities.

Additional posts payment-card data, CCTV access, paid channel placements, and custom targeting, broadening the operation beyond politically motivated website disruption.

The clearest example of attempted direct monetisation involved Amino. On October 19, 2025, GLITCH allegedly demanded $5,000 in cryptocurrency to stop claimed DDoS activity against the social platform.

The demand demonstrates an extortion attempt, but the supplied evidence does not establish payment or independently confirm the claimed attack’s impact.

Telegram bans repeatedly displaced Dark Storm’s channels and operator accounts. Replacement links circulated through backup communities and allied groups, allowing the brand to persist despite individual account removals.

Team1914 provided the strongest evidence of reciprocal cooperation, distributing replacement links after a September 2026 ban and publishing joint attack claims.

Dark Storm also repeatedly amplified NoName057(16) announcements and campaigns.

GLITCH’s appearance in a DDoSia-associated chat adds evidence of interaction with that ecosystem. It does not, however, establish shared infrastructure, operational command, or a formal alliance with NoName057(16).

Dark Storm’s campaign posts targeted government portals, financial institutions, transport organisations, and major online platforms across multiple countries. They commonly paired operation hashtags with Check-Host availability reports.

Such reports show whether particular probes can reach a website; they do not independently establish DDoS causation, outage duration, data compromise, or disruption to underlying services. Geographic blocking further complicates interpretation.

The investigation ultimately depicts a persistent, commercially opportunistic operation whose visibility exceeds its independently verified impact.

Its Telegram ecosystem connects propaganda, service advertising, extortion messaging, and allied amplification, but individual attack and access claims still require corroboration.

That distinction is central to assessing both the group’s actual capabilities and the operational significance of its expanding public catalogue without treating promotional material as proof.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC .

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

Weekly Cybersecurity – Top 50 Biggest Cybersecurity Stories of the Week

One Identity Unveils Safeguard 9.0 for Simpler PAM

One Identity Unveils Active Roles 8.6 with Enhanced Security and Administration

One Identity Unveils Identity Manager 10.0 LTS with AI and Modern UX

OffSec Celebrates 20 Years of Practitioner-Built Training From the Creators of Kali Linux and OSCP

Finite State Raises $27 Million to Help Device Makers Fight ‘Vulnpocalypse’ with AI-Powered Product Security