Dark Storm Team is accelerating its shift from political hacktivism toward a full-blown cybercrime business, offering distributed denial-of-service (DDoS) attacks for hire—and even extortion—to pressure victims into paying cryptocurrency. A November 6, 2026 research report lays out the modus operandi, including a $5,000 demand tied to an alleged attack on the Amino social app. Despite the claim being made in October 2025, there’s no external validation that Amino was disrupted or paid off.
From Hacktivist Claims to Extortion Business
Dark Storm first surfaced in late 2023, gaining notoriety for asserting responsibility for a major March 2025 outage impacting X (formerly Twitter). Since then, it has posted alleged attacks on government agencies, banks, airports and other platforms. However, available evidence rarely confirms the scale or success of those claims. Researchers following the group’s Telegram presence tracked its activities through accounts linked to a persona known as “GLITCH.”
In one key incident, GLITCH reportedly demanded $5,000 in crypto in October 2025, alleging impending DDoS attacks against Amino. Public claim of the attack followed days later, and the group resurfaced with another claim against Amino in October 2026. It remains unclear whether any damage occurred or if payments were made.
Pricing, Services, and Expansion Tactics
Dark Storm advertises a structured menu of cybercriminal services. Prices for DDoS range from $20 for three hours to $600 for a full month. Other offerings include access to social media accounts (starting at $250), website database dumps (from $50–$300), payment card data, CCTV access, and paid promotional channels.
Despite attempts by Telegram to ban their channels, Dark Storm persists through renamed replacement channels, backup accounts, and partnerships. In September 2026, a group called Team1914 promoted one such replacement. The group also amplifies posts from NoName057(16), shares campaign tags, and maintains connections—though researchers find no conclusive proof that they share attack infrastructure or collaborate directly on operations.
Researchers also assessed Dark Storm’s technical footprint, including multiple Telegram user IDs linked to GLITCH, main and backup channels established throughout 2025–26, and sales channels tailored to different services. The group’s claims often use publicly observable website status checks (like “Check-Host” reports), which can mimic evidence of outages even when unrelated causes are at work.”
Indicators of compromise include specific Telegram user and channel IDs—evidence that its core identity remains traceable despite tactic changes. Still, the report emphasizes that the infrastructure behind its supposed attacks isn’t clearly identified.
