Dark Storm Team Expands DDoS-for-Hire Operations, Demands $5,000 to Stop Alleged Amino Attack

Dark Storm Team is combining political attack claims with a growing cybercrime business, advertising distributed denial-of-service services and demanding money to stop alleged disruption.

A November 6, 2026, investigation documents its Telegram activity, including a $5,000 cryptocurrency demand linked to the Amino social app. The demand dates to October 2025, rather than a newly confirmed incident.

First observed in late 2023, the group gained attention after claiming responsibility for the March 2025 outage affecting X. Its later posts describe attacks against government websites, banks, airports, and online platforms.

However, the available evidence does not independently confirm every attack, its duration, or the damage claimed.

Researchers from StealthMole identified the commercial operation by tracking Telegram channels, account changes, and messages associated with the persona GLITCH.

Their investigation into Dark Storm describes DDoS services and extortion activity, not a newly identified malware family. That distinction matters because the report does not establish which attack software Dark Storm itself deployed.

Dark Storm Team Expands DDoS-for-Hire Operations, Demands $5,000

On October 19, 2025, GLITCH posted that the alleged DDoS activity against Amino would stop in exchange for $5,000 in cryptocurrency.

A formal attack claim followed on October 22, and the group returned to the target in October 2026. The report does not establish whether Amino paid or independently verify the claimed disruption.

The message shows a move beyond selling attacks to customers: the operator publicly used an alleged attack to pressure a target for payment.

This sits within the market illustrated by the NightmareStresser DDoS service takedown, where customers could purchase disruptive traffic without building their own attack infrastructure.

Dark Storm’s frequently reposted price list offered three hours of DDoS activity for $20, eight hours for $50, one day for $100, one week for $350, and one month for $600.

Cryptocurrency was the only advertised payment method. Promotions included an eight-hour service for $25 in late October 2026.

The catalogue extended beyond DDoS. A June 2026 menu advertised access to social media accounts starting at $250 and website database dumps from $300.

Other advertisements listed database dumping from $50, showing that prices varied between menus. Posts also offered payment card data, CCTV access, and paid channel advertising; these advertisements do not prove successful delivery. GLITCH acted as owner, spokesperson, and sales contact across several accounts.

Researchers linked renamed sales handles through a persistent Telegram user ID, allowing them to follow the commercial operation despite changes in its public presentation. This continuity provides stronger evidence of account relationships than matching display names alone.

Telegram Resilience, Alliances, and Limits of the Evidence

Repeated platform bans did not remove Dark Storm’s presence. Replacement channels appeared throughout 2025 and 2026, while backups and allied communities circulated fresh links. In September 2026, Team1914 helped promote a replacement channel.

The pattern adds detail to earlier reporting on pro-Russian hacktivist group alliances involving Dark Storm and other groups.

The relationship with Team1914 included reciprocal promotion and joint attack claims. Dark Storm also regularly forwarded NoName057(16) posts and adopted its campaign tags.

However, researchers distinguished this amplification from a proven operational partnership. Shared targets, forwarded messages, and overlapping hashtags cannot establish that groups share infrastructure or jointly execute attacks.

GLITCH also appeared in a DDoSia Project chat in October 2026 and identified himself as Dark Storm’s owner. Previous reporting on NoName057(16)’s DDoSia attack tool explains its volunteer-driven model, but that appearance does not demonstrate that Dark Storm used the tool.

The report leaves the group’s underlying attack infrastructure unresolved. Many attack posts relied on Check-Host availability reports. These show whether selected probes can reach a website, not why access failed. Geographic restrictions, unrelated outages, or defensive filtering may produce similar results.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Dark Storm Team Expands DDoS-for-Hire Operations, Demands $5,000 to Stop Alleged Amino Attack appeared first on Cyber Security News.