Does Stormous define itself primarily as a financially-driven or politically-driven organization, or is it a mix? Are your actions and target selections shaped by ideological alliances or mostly by economic opportunity?

As a group, Stormous focuses its operations primarily on strategic objectives, which often blend financial and political motivations. Target selection is guided by both perceived ideological alignment and economic opportunity; however, operational focus tends to prioritize opportunities that maximize impact, both financially and in terms of influence.

Where does Stormous draw the red line when choosing targets? Are there specific sectors or organizations you refuse to attack for moral, ethical, or humanitarian reasons?

Yes, absolutely, and this is an important point I focus on. From my perspective, I instruct anyone under my supervision not to attack humanitarian services such as hospitals, private clinics, and healthcare centers. The problem often lies with the affiliate responsible for accessing; in many cases, they either leak or sell data secretly without locking the network. Yes, we know our actions can be perceived as malicious, but the damage we cause in other sectors is considered less harmful than causing damage in sectors that directly impact people.

Stormous has recently announced alliances with Devnman, Coinbase Cartel, Radar, and other ransomware groups. What motivates these partnerships, and how do you ensure operational security and the trustworthiness of group members?

Regarding the alliance formed this month: most of these services do not have their own locker, only a few do (I won't go into further details). Therefore, we usually collaborate with them, whether they are suppliers of access or exploiters themselves. We also try to benefit from shared payloads, RAT services, phishing campaigns, etc. At the moment, we haven't fully integrated our work because, as I mentioned, trust is required. Currently, the community mainly serves as a communication platform, organizing tasks and understanding our operational methodology. Members of different groups are not merged; each team operates independently within its own section.

Multiple cybersecurity sources have raised doubts about the legitimacy of your claimed attacks, with some companies denying breaches or classifying shared data as fabricated. How do you respond to these accusations?

This is a crucial topic, and I want to emphasize it. Initially, I would integrate anyone under our network without restrictions, conditions, or fees, allowing them the right to leak via our DLS. In most cases, we did not verify details such as file trees, access levels, or tracking. Consequently, much of the data involved either came from previous leaks or other sources. We have since addressed this issue: any data affecting us is carefully monitored, and individuals violating rules are removed. Challenges also arise from media, or companies seeking to hide that they were attacked. Now, we exercise strict monitoring of anyone connected to our services regarding target testing.

The FBI and global law enforcement have dismantled many ransomware operations in recent years. Stormous survived for over three years. What's your secret to longevity, and what do you do to avoid infiltration or arrest?

The key principle is not attacking anything directly linked to them. I believe the idea is understood. Many of our associates, like Ragnar Locker and others, were apprehended, but this does not deter us. I think it's not about avoiding arrest but about timing: perhaps the right moment has not yet arrived, or maybe we still have some operational freedom.

Have you ever refused to attack a particular target or waived a ransom demand due to humanitarian or ethical reasons? If so, can you share a real example?

There was an incident with a Cameroonian hospital in 2023. After the attack and publication of the target, I monitored the negotiations. The hospital was truly incapable of paying even $30,000 at the time. I provided a timed free encryption tool and requested an apology through our channels. This is why strict rules were established regarding not attacking such services.

What is the weirdest request you have ever received from a victim during negotiations?

"Can I collaborate with you?" (Company with revenues exceeding $40M+)

Every individual, even on unconventional paths, draws inspiration from somewhere. Is there a particular book, film, or figure that shaped your worldview or influenced your approach?

To be realistic, as an ordinary person and not a ransomware operator: everyone is influenced by various factors throughout life. Personally, reading and practical experience have shaped my worldview, especially regarding the power of information and surveillance. Documentaries about technology and cybersecurity have also provided real-world context, helping me understand the societal impact of technology and many other factors.

How is the adoption of AI technologies changing the landscape for Stormous and the ransomware ecosystem? Are you using machine learning or generative AI for developing malware, automating attacks, or negotiating with victims?

I believe the future of attacks will involve artificial intelligence and a new generation of ransomware, which will simplify tasks like encryption, payload construction, and other operations. While we have only used AI in select areas where necessary, we have maintained our own encryption versions for a long time, updating them as needed. In the future, either we or associates under my team may integrate AI more extensively.

Do you have any final words or messages you would like to share with my followers?

The world is changing fast: the internet evolves daily, and AI now plays a major role. Any data that people or organizations release can come back to haunt them if not properly protected. Stay vigilant, develop your skills and defend yourselves. Awareness and caution today are your protection tomorrow. Thank you for your questions and your interest.