Threat Actor Characterization
DesertStorm
ID: dc6e7baf0a1acfa234a4928e32cef34b55405Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
4d2f0e42b048e86a7323dc689171d97c | el farado | Unknown | ally-of | Cybercrime |
|
69cc5ffdc20c5e83a0f6b788a05a102963856 | FunkSec | Russia | ally-of | Crimeware |
|
5d0f5219d1a5557d70758202f92e007659518 | Scorpion | Russia | ally-of | Cybercrime |
|
|
5da217af8d9dac2a11d516c9b747c0cf64481 | XTN | Niger | ally-of | Cybercrime |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
DesertStorm is an online persona described in multiple OSINT reports as an associate/promoter linked to the FunkSec ransomware ecosystem, often connected to the alias 'Scorpion'. Reporting emphasizes claims/leak amplification and forum activity; direct technical artifacts (malware/C2) attributable to the persona are not established. ATT&CK mapping is therefore constrained and avoids attributing ransomware execution steps to the persona without direct evidence.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1585.001 | Social Media Accounts | TA0042 | |
| T1584.001 | Domains | TA0042 |
|
DesertStorm — Persona / Promoter Associated with FunkSec (Ransomware Ecosystem)
Classification: TLP: WHITE — Open Source Intelligence (OSINT)
Category: Cyber / Hybrid — Underground forum presence; ransomware-adjacent promotion; claims ecosystem
Assessed home base: Algeria (OSINT-based assessment; see confidence notes)
Executive Summary
DesertStorm is an online persona assessed to be closely associated with the early promotion and ecosystem visibility of the FunkSec ransomware brand. Multiple independent OSINT reports describe DesertStorm as an alias of (or interchangeable with) “Scorpion,” a figure publicly linked to FunkSec-related posting activity and underground forum presence.
Reporting also highlights operational security lapses allegedly made by the persona (e.g., revealing location context in a publicly posted screenshot), and notes that DesertStorm/Scorpion was banned from Breached Forum in late 2024 after continued leak postings. These observations support an assessment that DesertStorm functioned primarily as a promoter/participant in a claims-and-leaks ecosystem, with mixed reliability of claims.
Confidence is medium–high that DesertStorm is materially linked to FunkSec’s public ecosystem footprint (as a promoter/associate persona), and medium that the persona’s operational base is Algeria based on OSINT assessments. Confidence is low–medium for any direct involvement in ransomware development or hands-on intrusion activity, as most reporting frames DesertStorm as a promoter/associate rather than a confirmed operator with technical artifacts attributable to the persona.