Stealthmole investigation identified

Over the past few years, hacktivist groups have become more organised in how they operate and present themselves online. What once started as small, loosely connected collectives has gradually developed into a network of groups that maintain multiple Telegram channels, announce alliances, cross-promote attack claims, and use major geopolitical events to gain visibility.

Dark Storm Team is one such group. First observed in late 2023, it gained widespread attention in March 2025 after claiming responsibility for a large-scale outage affecting X (formerly Twitter) . The incident brought the group into the spotlight, attracting attention from media outlets, cybersecurity researchers, and even Elon Musk himself.

Despite the attention, there is still no clear picture of what Dark Storm Team actually represents. It has been described as a pro-Palestinian hacktivist group, associated with the pro-Russian hacktivist ecosystem, and linked to the commercial sale of DDoS attacks. These descriptions are not necessarily contradictory, but they raise questions the group's actual structure, affiliations, and activities beyond its public attack claims.

To get a closer look, this investigation moved beyond public reporting and focused on Dark Storm Team's own activity across Telegram. Using StealthMole, we followed the group's channels, tracked changes in its online presence, and examined the accounts and communities interacting with it. The investigation revealed a network built around a recurring persona, multiple channel migrations, a steady stream of claimed attacks, commercial DDoS offerings, and connections with other hacktivist groups.

The Face Behind the Storm

Behind Dark Storm Team's public activity is a recurring persona known as GLITCH . Across the Telegram channels examined during this investigation, GLITCH consistently appeared as the group's owner, spokesperson, and point of for its commercial services. He announced new channels, published attack claims, issued threats against critical infrastructure, and personally handled purchase enquiries.

His public statements also made little attempt to hide the group's intentions. In May 2026 , he posted a direct threat against critical infrastructure, stating that the group would attack it " when I want ". The message ended with a simple signature: " -GLITCH ".

However, the account behind this persona has not remained the same. On 1 May 2025 , a pinned message in the Dark Storm chat announced that Telegram had banned the team's owner and that an investigation was underway. By the following day, GLITCH had returned under a different account. He told members that his account had been banned without explanation and added that the group now knew "how to not ban again".

Using StealthMole's Telegram Tracker, we pivoted from GLITCH's known user nodes to identify the accounts associated with the persona. This revealed several accounts used for different purposes over time:

Main owner account used since May 2025: @MRHEL***1 ( User ID: 6147437922 )

Declared backup account: @MRHEL****3 ( User ID: 8398245341 )

Account used for sales and service enquiries, renamed in mid-2026: @glitch****1 → @MRHEL*****2 (User ID: 8797265807 )

Earlier owner account, banned in May 2025: @DarkStorm****3

A more revealing connection emerged on 21 October 2026 , when GLITCH appeared in a Telegram chat called DDoSia Project . The group is used by NoName057(16) volunteers operating the group's DDoS client. GLITCH introduced himself with the message " its me darkstorm " and then asked whether anyone recognised him.

When another participant jokingly questioned whether he was really the administrator of Dark Storm, GLITCH replied, " i am owner ". A responder answered in Russian that they already knew and that there was no need to announce it.

The exchange provided a direct example of GLITCH identifying himself as Dark Storm's owner in a community associated with another hacktivist operation.

The conversation became more unusual shortly afterwards. GLITCH wrote that he needed help " from putin to use nuclear on usa, europe ". Another participant pointed out that his profile indicated he was from Russia and questioned why he was communicating in English. GLITCH responded in Russian, explaining that he did not speak with many Russians .

While the exchange offered a glimpse into how GLITCH presents himself within other hacktivist communities, it did not establish a formal relationship between Dark Storm and NoName057(16) . What it did confirm was that the persona was willing to publicly identify himself as the owner of Dark Storm in a chat associated with the DDoSia project .

But identifying the operator behind an online persona is a different challenge altogether.

On 7 October 2025 , an Indian hacktivist channel published a post titled " Owner of TEAM DARK STORM ". The post was subsequently forwarded into the Bhartiya Hunters chat. It listed two of GLITCH's Telegram accounts alongside their user IDs, followed by what it claimed were the owner's real identity, details, address, and profile.

At first, the post appeared worth investigating. The Telegram handles and user IDs matched accounts already associated with GLITCH. However, this did not independently validate the identification. Those account details had already been publicly disclosed by GLITCH himself, meaning they offered no new evidence of the operator's real-world identity.

We then examined the remaining information through StealthMole. Several inconsistencies emerged. The post combined several details within the same profile, while the document number it provided appeared to be a sequence of digits taken directly from the listed phone number. A pivot using the associated landline in StealthMole's Dark Web Tracker returned only unrelated database dumps in which the same digits appeared as record values.

The profile associated with the listed mobile number was consistent with the name mentioned in the post. However, there was no evidence connecting that profile, phone number, or identity to any of GLITCH's Telegram accounts.

The source was a rival hacktivist group, the information could not be independently corroborated, and the inconsistencies raised further questions its reliability.

Built to Survive Bans

If there is one thing Dark Storm Team has demonstrated over time, it is its ability to rebuild its online presence after repeated platform bans.

Telegram has removed several of the group's channels, chat groups, and owner accounts. However, each removal was followed by a replacement, often within a short period. New links were circulated through backup channels, existing chat groups, and allied hacktivist communities. By tracing these changes through StealthMole's Telegram Tracker, we were able to reconstruct how Dark Storm's Telegram infrastructure developed from early 2025 through September 2026 .

The first major disruption came in May 2025 , when Telegram banned the group's owner account. GLITCH responded by announcing a replacement account and sharing a backup channel, asking existing members to move there. Additional channels appeared over the following months:

Backup channel shared in May 2025: t.me/Darkstorm*****2

Channel first observed in June 2025: t.me/darkstorm*****1

Channel first observed in August 2025: t.me/darkstorm***f

Main channel from October 2025: t.me/Darkstorm**k (Telegram ID: 3171169119 )

X account announced and pinned on 27 October 2025: x.com/dark******3

The same cycle continued throughout 2026. By March, a new main Telegram channel was active. On 5 May, Dark Storm announced another replacement channel alongside a new chat group. The September migration was particularly revealing because the replacement was not by Dark Storm alone.

In early September, another Dark Storm channel was removed. This time, Team1914 , one of the group's closest allies, circulated the announcement to its own followers, referring to Dark Storm as " our alliance Dark Storm Team " and sharing the replacement links. Within hours, Dark Storm had established another channel, which immediately informed members that the one had been banned.

The successive replacements included:

Main channel by March 2026: t.me/Dark**Storm**** (Telegram ID: 3576990196 )

Created on 5 May 2026: t.me/Darkstorm****2 (Telegram ID: 3908675424 )

Chat group established in May 2026: t.me/darkst***s (Telegram ID: 3900953888 )

Created on 7 September 2026 and identified as the current main channel in the investigation: t.me/darkst****9 (Telegram ID: 4473764827 )

Reconstructing the Channel Network

The Telegram Tracker results allowed us to consolidate the group's known channels and chat groups into a single timeline. Rather than treating each replacement as an isolated account, we used the recurring names, announcements, account references, and cross-posted links to map their relationship with the wider Dark Storm presence.

The group's presence on X showed a similar pattern. Several handles appeared in October 2025 alone, reflecting the repeated changes to its social media accounts:

x.com/Darkstorm*****2

x.com/Darkstorm*****s

x.com/Darkstorm*****0

x.com/darkteam******3

What stands out is that Dark Storm's continued presence does not depend on a single Telegram channel or social media account. The group maintains alternative channels, announces replacements through existing communities, and benefits from allied groups that help distribute new links when its own channels disappear.

The September 2026 migration involving Team1914 is particularly important in this regard. It shows that Dark Storm's recovery process can extend beyond its own network, with allied channels helping it maintain visibility and reconnect with followers.

With the group's communication infrastructure mapped out, the investigation moved to the activity taking place across these channels. Beyond maintaining its presence, what was Dark Storm actually claiming, offering, and coordinating?

Dark Storm's Telegram channels serve another important purpose beyond maintaining the group's online presence: they provide a running record of its claimed attacks.

Most posts follow a familiar format. A target website is listed alongside a red cross symbol, followed by a Check-Host link presented as proof that the website is unreachable. The posts usually end with hashtags such as #DARKSTORM , #DARKSTORMTEAM , and a campaign-specific tag like #OpGermany or #OpEstonia . Some claims also include the phrase " closed by geo ", suggesting that the target may have restricted access based on the visitor's geographical location.

Reviewing these posts chronologically through StealthMole's Telegram Tracker revealed how the group's targeting developed over time. Its earlier activity focused heavily on popular online platforms, but gradually expanded into country-specific campaigns involving government institutions, financial organisations, transport infrastructure, and other critical services.

Late 2025: Platform Attacks and the Canada Campaign

The main channel active from October 2025 initially showed a strong focus on high-profile online platforms. Within its first few weeks, Dark Storm claimed attacks against , Ancestry , Netflix , the Amino app , and even the cybercrime forum DarkForums.

t.me/Darkstorm*****k ( Telegram ID: 3171169119 )

On 24 October 2025 , the group added SpaceX to its list of targets. It later reposted a TechNadu article covering the claim, suggesting that media attention was also an important part of how Dark Storm presented its operations.

The same period marked the beginning of a more sustained national campaign under #OpCanada . Over several days, the group published claims involving a Canadian national security and intelligence portal , regional airports , public transport services , taxi companies, and the Federation of Canadian Municipalities .

These campaigns showed that Dark Storm was no longer limiting its activity to recognisable online platforms. Government and public infrastructure had become a regular part of its target selection.

Early 2026: European Targets and #OpAustria

The activity became more concentrated in May, when the group launched #OpAustria ahead of Austria hosting Eurovision 2026 . Its newly established channel published claims involving the city and airport of Graz, BAWAG and Euram banks and others.

The group also shared an Austrian news article discussing rising cyberattacks around the Eurovision contest, connecting its own claims to the wider attention surrounding the event.

t.me/Dark**Storm**m (Telegram ID: 3576990196 )

t.me/Darkstorm****2 (Telegram ID: 3908675424 )

Austria was part of a much wider targeting pattern during this period. Other posts involved Ukrainian cities and defence enterprises, Israeli government ministries and banks, UK energy and drone companies, and South Korean government services, including the Ministry of Education and e-government portals.

One particularly notable claim concerned London Gatwick Airport . Dark Storm stated that the airport had been " down for like 1-3 hours ", presenting the alleged disruption as a significant achievement.

Over the following months, the group continued adding targets across Europe and the United States. These included Luxembourg's national railway and government ministries, Polish defence companies and the Warsaw Stock Exchange , as well as US Federal Student Aid portals .

September–November 2026: The Expanding #Op Campaigns

The channel created in September 2026 became the most active source of campaign claims identified during this investigation.

t.me/darkstor******9 (Telegram ID: 4473764827 )

From its first week, the channel began publishing a series of country-specific campaigns. Each followed the same naming convention, with an operation hashtag identifying the country and accompanying posts listing the alleged targets.

The campaigns covered Estonia, Germany, Poland, Romania, the Czech Republic, Italy, and France . The targets included government ministries, national portals, defence manufacturers, airports, transport services, financial institutions, and major technology companies.

The German campaign was particularly broad , with claims involving the Ministries of Justice and Defence, the Federal Foreign Office, regional transport services, city portals, federal courts, and the Federal Criminal Police Office (BKA) . The French campaign similarly extended beyond government websites to include energy company EDF, OVHcloud, and telecom operator La Poste Mobile.

Two campaigns in October stood out because they moved beyond the group's predominantly European targeting.

Under #OpSaudiArabia , Dark Storm claimed attacks against Saudi ministries, three international airports, and Bank Al-Bilad. The campaign was introduced with the phrase " support for Yemen ", providing an explicit political message behind the targeting.

A few days later, the group published claims involving North Korean government and state media websites , including the national portal Naenara and the Pyongyang Times.

Alongside these national campaigns, Dark Storm continued targeting well-known online platforms. Its posts included claims involving , the Internet Archive, 4chan, DeviantArt, Pixiv, OnlyFans, and Archive of Our Own. US-based targets also appeared, including the New York Police Department and the Treasury's Electronic Federal Tax Payment System (EFTPS). The #OpUSA campaign also included Robinhood.

The following table consolidates the major campaigns identified across the group's Telegram channels during the investigation.

, Netflix, SpaceX, , 4chan, Internet Archive

Intelligence portal, regional airports, municipalities

Bank of Finland, Danish airports

Graz airport, BAWAG, Vienna Stock Exchange, power grid

City portals, Kyiv airport, defence plants, Parliament

Darkstorm***2, darkstorm****9

Gatwick Airport, energy and drone companies

National railway, Interior and Digitalisation ministries

State portal, Ministry of Finance, Parliament

Ministries, BKA, federal courts, transport

Defence manufacturers, county administrations

Justice, Education, Health ministries

Police, Václav Havel Airport, government

Bank of Italy, ports, Ministry of Defence

Ministries, EDF, OVHcloud, La Poste Mobile

Ministries, airports, Bank AlBilad

Naenara portal, state media

NYPD, EFTPS, Robinhood

Assessing the Attack Claims

The volume and geographical spread of Dark Storm's claims are considerable. However, the evidence attached to these posts does not always establish the impact the group describes.

Dark Storm frequently uses Check-Host reports to demonstrate that a target is unreachable. These reports provide a snapshot of website availability from a limited number of probes. They do not independently establish whether a DDoS attack took place, how long an outage lasted, or whether the website was inaccessible for an unrelated reason.

The group's own use of the phrase " closed by geo " makes this distinction particularly important. A website restricting access based on geographical location should not automatically be treated as evidence of a successful attack.

There is also a precedent for overstating impact. During the widely publicised X incident in March 2025, the Check-Host screenshot shared by Dark Storm as proof showed a single X profile being targeted rather than demonstrating that the entire platform was unavailable.

Another pattern emerged when comparing D ark Storm's posts with announcements from other hacktivist groups . Several targets, including Luxembourg's national railway, the Corsica Linea maritime training center, and the BKA portal, appeared in Dark Storm's claims only days after NoName057(16) had published claims involving the same targets.

The timing raises questions whether Dark Storm participated in the same operations or simply checked and republished targets already circulating within the wider hacktivist ecosystem. The Telegram posts alone are not enough to establish which explanation is correct.

The campaigns show a group that places considerable importance on visibility. Its targeting spans government institutions, financial organisations, transport services, and internationally recognised online platforms. The country-specific hashtags also give its activity the appearance of organised campaigns, although the available evidence does not establish the actual scale or impact of every claimed attack.

However, the group's activity is not limited to public attack announcements. Dark Storm also advertises DDoS services to paying customers, introducing a commercial side to its operations that deserves separate examination.

Hacktivism as a Storefront

Dark Storm's Telegram channels are not just used to publish attack claims. They also serve as a marketplace for the group's services.

Website database dumping

Payments are accepted exclusively in cryptocurrency, with potential buyers directed to GLITCH's sales account. The price list is usually accompanied by a short message inviting customers to make . Occasionally, the group introduces promotional offers to attract buyers, including a 50% discount available until the end of May 2026 and an eight-hour DDoS service advertised for $25 in late October 2026 .

The sales has also changed over time, although the underlying Telegram accounts provide continuity:

@MRHEL****1 – Used until early 2026.

@glitch****1 – Used between May and July 2026.

@MRHEL*****2 – Used from July 2026 onwards.

The last two usernames belong to the same Telegram user ID, 8797265807 , previously identified as GLITCH's sales account.

From Attack Claims to Direct Payment Demands

The commercial side of Dark Storm's activity was not limited to advertising services in advance. In at least one instance, GLITCH directly connected an ongoing attack claim to a payment demand.

On 19 October 2025, he published a message stating that the DDoS activity against the Amino social app would stop if the company paid $5,000 in cryptocurrency . He followed this with a warning that anyone contacting him Amino would be blocked.

A formal attack claim against Amino appeared on 22 October 2025 , and the group returned to the same target in October 2026.

A Broader Catalogue of Services

Hacking and information gathering: Services advertised using the wording "DD0S, DOX, H4CK database of site" in November 2025.

Surveillance access: Offers involving access to CCTV cameras in Germany and the United States in October 2026.

Advertising placements: Paid promotional slots on Dark Storm's Telegram channels, with enquiries directed to @MRHEL*****2 .

Custom targets: A standing invitation for potential customers to "send target" directly to the sales account.

Friends in Loud Places

Dark Storm's Telegram activity shows that the group operates within a wider hacktivist network. Some relationships involve mutual promotion and joint attack claims, while others are based on shared campaign messaging or the redistribution of each other's content. The strongest connections identified during this investigation were with Team1914 and NoName057(16) , although the nature of these relationships differs.

Team1914 and the Disrupt0r Alliance

The clearest two-way relationship was with Team1914*******l .

It first became visible in September 2026, when Team1914 began tagging #DarkStormTeam in its attack claims under a shared banner called Disrupt0r . When Dark Storm lost its Telegram channel that month, Team1914 announced that its alliance partner had been banned and circulated replacement links. Dark Storm subsequently returned the favour by sharing Team1914's backup channel links.

The relationship was also reflected in their attack claims. On 2 October 2026 , Dark Storm claimed that it had taken Israel's Mossad website offline in collaboration with Team1914 and wiped . Team1914 published the same claim minutes later under the banner " DARKSTORM x TEAM_1914 x wiped ".

Another indication of their overlap appeared that day, when Team1914 published claims involving CCTV systems in Japan, Germany, the Netherlands, and Italy, tagging them with #DarkStormTeam alongside #NoName057(16) , #Disrupt0r, and RBL Leviathan Ghost . Less than a day later, Dark Storm began advertising access to CCTV cameras in Germany and the United States. The timing suggests a possible connection between the activity, but the available posts do not establish whether the groups shared access or were simply using the same branding.

NoName057(16): An Amplification Relationship

Dark Storm's connection with NoName057(16) appears different. Rather than a clearly declared alliance, the evidence points to a pattern of repeated amplification and alignment with the group's campaigns.

Since at least May 2026, Dark Storm's channels have regularly forwarded posts from NoName057(16)'s Russian and English-language channels. Dark Storm also adopted campaign hashtags associated with the group, including #NONAME057 , #FuckEastwood , and #TimeOfRetribution .

This activity continued when NoName057(16)'s channels and DDoSia group were banned in October 2026 . Dark Storm relayed the group's bot and replacement channel link within a day. It also forwarded the announcement of NoName057(16)'s Tor portal approximately three and a half hours after its launch on 26 October.

The relevant sources identified through Telegram Tracker were:

Russian-language channel - Telegram ID: 3087552512

English-language channel, " NNM057(16) eng vers " – Telegram ID: 3869927851

Tor portal – nnmo57***********************************jnid.onion

GLITCH's appearance in the DDoSia Project chat provides additional context, although it does not independently establish a formal operational relationship with NoName057(16) . Overall, Dark Storm's repeated promotion of the group's channels and campaigns suggests close alignment and an active role in amplifying its activity. The precise nature of that relationship remains unclear and is examined further in the separate NoName057(16) report.

Other Declared Alliances and Connections

Several other groups publicly announced relationships with Dark Storm. These were mostly identified through announcements forwarded to Dark Storm's own channels:

ZagNet: On 31 October 2025, announced that it had officially entered an alliance with Dark Storm and would work with the group.

OverFlame: On 2 November 2025, announced its "unification" with Dark Storm in a Russian-language post.

PalachPro: On 15 November 2025, Dark Storm itself announced an alliance and shared the group's channel.

CyberTroll Team: On 9 October 2026, published a "CyberTroll x DarkStorm" announcement. Dark Storm subsequently reposted its claims involving Rome, France's ANSSI, and several Swedish cities.

Other names appeared more narrowly in the collected data. wiped was named alongside Team1914 in the Mossad claim, while BNCT1360 and RBL Leviathan Ghost appeared in Team1914's joint hashtags. These references establish campaign-level overlap, but not necessarily direct relationships with Dark Storm.

The relationships identified here vary considerably in strength. Team1914 has the clearest evidence of reciprocal cooperation, while NoName057(16) is repeatedly amplified by Dark Storm. Other groups appear through public alliance announcements, joint campaign references, or advertising exchanges. This distinction matters: appearing alongside Dark Storm in a post does not automatically make a group an operational partner.

When Dark Storm first attracted public attention, it was widely described as a pro-Palestinian hacktivist group. Its early threats focused on Israel, NATO members, and countries perceived as supporting Israel. This was also the image that shaped much of the coverage following the 2025 X outage .

This positioning is reflected in its recent activity. Dark Storm regularly forwards NoName057(16) material targeting European support for Ukraine , including posts German military aid and NoName's "Tribunal" campaign against European politicians. It has also adopted NoName's campaign hashtags, while its declared ally OverFlame used explicitly pro-Russian messaging when announcing its partnership with Dark Storm .

Yet the group's activity does not fit neatly into a single political alignment. In September 2026 , Dark Storm published a post featuring the Yemeni flag with the hashtag #YEMEN . The following month, it launched #OpSaudiArabia with the stated message " support for Yemen ", targeting Saudi institutions and directing an insult at Crown Prince Mohammed bin Salman. Israeli targets have also continued to appear in its attack claims.

The group also appears conscious of its public reputation. In October 2026 , it reposted a March 2025 post by a security researcher who had claimed to identify the individuals behind the X outage. Dark Storm labelled the repost a " throwback " and mocked the researcher's attribution.

The available evidence points less to a clearly documented change in ideology than to a shift in the groups and causes Dark Storm chooses to associate itself with. Its recent messaging shows stronger alignment with the pro-Russian hacktivist ecosystem , particularly NoName057(16) , while its activity continues to draw on other geopolitical grievances. Whether this reflects a genuine ideological shift or a strategic effort to expand its alliances and audience cannot be established from the Telegram activity alone.

Dark web investigations rarely provide a complete or definitive picture. Public claims can be exaggerated, identities difficult to verify, and relationships open to more than one interpretation. This case demonstrates how StealthMole's historical Telegram data and cross-account tracking can help investigators follow activity across channel bans, account changes, and shifting alliances, while keeping those uncertainties visible rather than treating every connection as proof.

To access the unmasked report or full details, please reach out to us separately.

us: [email protected]

Labels: Featured , Hacktivist Group