Dark Storm Team sells DDoS, dumps and stolen access on Telegram
Original title: Dark Storm Team Offers DDoS Attacks, Database Dumps, and Stolen Access Through Telegram Channels
StealthMole says the advertised prices and extortion claims are not verified transactions or proven outages.
A StealthMole investigation describes Dark Storm Team using Telegram to advertise DDoS attacks, database dumps, compromised accounts and surveillance access alongside hacktivist claims. First observed in late 2023, the group claimed the March 2025 outage of X, which X did not confirm. Ads listed three-hour DDoS attacks for $20 and database dumps from $50 to $300. An alleged $5,000 cryptocurrency demand against Amino is not shown to have been paid. Telegram bans have not stopped the brand.
Unconfirmed: Attack, access and identity claims remain uncorroborated, and X did not confirm Dark Storm's involvement.
- One sales account kept Telegram user ID 8797265807 through 2026 name changes.
- A one-month DDoS service was advertised at $600; account access started at $250.
- GLITCH is described as the owner persona, not a confirmed real-world identity.
- Team1914 shared replacement links after a September 2026 ban.
- Check-Host reports do not independently prove DDoS causation or data theft.
- Threat actors
- Dark Storm TeamNoName057(16)Team1914
- Organizations
- StealthMole
From the original article
3 min read at gbhackers.com
Dark Storm Team uses Telegram as both a hacktivist broadcasting network and a cybercrime storefront, advertising distributed denial-of-service attacks, database dumps, compromised accounts, and surveillance access.
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.