In January 2007, Windows users around the world began receiving emails with subject lines like “230 dead as storm batters Europe.” Inside — an attachment with details of a supposedly catastrophic storm sweeping the continent. Those who opened it launched an executable — a loader that deployed on the machine a chain of modules from game0.exe to game5.exe and the wincom32.sys rootkit in the Windows system folder. In the very first days antivirus companies identified the campaign, which was given the names Storm, Nuwar, and Peacomm, but infections continued: the operators changed email subjects, using messages about political scandals, celebrity deaths, holiday greeting cards. Social engineering worked like an assembly line: anxiety, curiosity, greed — and a click.
But Storm was not a single virus. It was an infrastructure capable of receiving new modules, changing its behavior, attacking its adversaries. It had no command server from the start: infected machines looked for instructions from each other in the eDonkey/Overnet distributed hash table, and in the fall of 2007 the operators moved to their own encrypted network built on the same principle. Legend had it that such a network was impossible to kill. The truth turned out to be more complicated: P2P made takedown more expensive, but not impossible. And the sensational estimates of tens of millions of infected devices were never reliably confirmed.
Storm’s infection chain was like a matryoshka doll. The first executable — game0.exe — loaded the next one, that one the next, until the machine held the full set of components. The final module installed the wincom32.sys rootkit in the %windir%\system32 directory, hiding the malware’s presence from antiviruses and the user. The rootkit intercepted system calls, masked files, processes, network connections. The machine kept running, but now it was part of someone else’s infrastructure.
The multi-stage design made it possible to evade detection. Antivirus signatures tuned to one file would not trigger on the next. Storm’s operators repacked the executable modules every ten minutes, so the same loader changed its checksum in the middle of a mailing. In December 2007 they threw hundreds and thousands of versions into the wild at once, hoping to overwhelm antivirus labs.
But the trick was in what it could do. Storm did not install a fixed set of programs. The rootkit worked as a platform capable of receiving new modules on command from outside. Today an infected machine was sending spam, tomorrow — taking part in a DDoS attack, the day after — downloading and spreading other malware. The operators turned the botnet into a multi-purpose, service-on-subscription tool.
Early botnets relied on IRC servers or HTTP control panels. Take down the server — and the network falls apart. Storm took a different path. Infected machines were joined in the Overnet distributed hash table (DHT), where each node stored a fragment of information about its neighbors, and in the fall of 2007 the operators added their own network — researchers called it Stormnet. Commands traveled along a chain: a bot looked for instructions from its neighbors, they from their neighbors, until it found a fresh one.
This was not Storm’s invention. The Overnet protocol had been used in file-sharing networks since the early 2000s. But to use it to control a botnet — that was something else. In torrents DHT helped find files; here it delivered commands to tens of thousands of machines at once, with no single point of failure. Messages in Stormnet were encrypted with a 40-byte XOR key, but the content was not signed — and that turned out to be a weak spot.
Defenders ran into a problem. You couldn’t just take down a server — there wasn’t one. You couldn’t block a domain — the bots didn’t contact domains. You could try sinkholing — replacing nodes in the network with your own servers that track activity. But Storm’s P2P architecture proved resilient: bots checked their neighbors, discarded dead nodes, looked for new ones. Researchers were forced to move more slowly: block propagation through spam filters, clean infected machines one by one, put pressure on supporting infrastructure like Fast Flux DNS — the technology that constantly changes the IP addresses of control nodes.
At first Storm lived inside the ordinary Overnet, side by side with benign file-sharing clients; the Stormnet network was closed — only bots were let in. There was no signature on the content, and in April 2008 a team of researchers from Mannheim and Eurecom flooded the DHT with their own records in the same format: instead of fresh instructions, bots began pulling garbage. And the operators, it seems, split the network into segments: different keys for different tasks. One segment sent spam, another attacked websites, a third spread new malware — compromising one part did not expose the rest.
In the summer of 2007, the sites of several anti-spam organizations came under massive DDoS attacks. Among the targets — Spamhaus, which maintains blacklists of spam servers, and 419eater.com, a forum that exposes scam schemes. The attacks came from the Storm botnet. This was no coincidence: the operators carried out part of the strikes themselves, protecting their infrastructure, and part on order, because DDoS, judging by reports from anti-spam sites, could be bought from them just like a mailing.
Researchers who published details about Storm also came under fire. Attacks lasted for hours, sometimes days. Bandwidth was clogged with junk traffic, sites became unreachable. Some researchers reported personal attacks: bots tried to knock out their home connections. It was a message: you dig — you get hit.
But Storm went further. In October 2007 the rootkit learned not to kill antivirus but to cut its power at the entry point: the malware patched entry points in loaded processes, and protection would open as usual but do nothing. “It works, but it doesn’t work,” as IBM researcher Josh Corman put it. The user saw antivirus turned on and considered themselves safe.
In September 2007 Microsoft released an update to Malicious Software Removal Tool (MSRT), adding detection for Storm. The results were curious: out of 2.6 million systems scanned, the tool cleaned 274,372 machines. That was about 10.5% of those scanned, but far from the estimates of tens of millions infected circulating in the press. The problem of measuring a botnet: the P2P architecture made it impossible to count unique nodes accurately. Researchers saw traffic but could not distinguish a permanently active machine from one that was turned on once a week. Estimates ranged from hundreds of thousands to 50 million, although the latter figure had no reliable confirmation.
By the fall of 2007 Storm was no longer a single operation. Researchers discovered that the operators were renting out parts of the botnet. The mechanism worked through unique encryption keys: a renter received a key that allowed them to send commands to their segment of the network. Bots carried out tasks but could not switch to another customer without a new key.
Price lists were not published, but researchers inferred prices from indirect signs. A spam mailing from a million machines, a DDoS attack on a chosen site, distribution of new malware — everything had a market price. Storm became an infrastructure on which dozens of schemes ran: from fake online pharmacies to fraudulent credit offers.
But who was behind the operation? The identities of Storm’s operators were never publicly established. No arrests, no court cases, no names. That set Storm apart from later botnets like Gameover Zeus, where the FBI eventually named suspects. F-Secure leaned toward a Russian trail: the operators hosted through the Russian Business Network, the code mentioned hatred for “Kaspersky Lab,” and one word inside the program — bydloshka — looked Russian. There was no proof.
The operators’ anonymity was reinforced by the architecture. The P2P network did not require the controllers to be permanently present. Commands were thrown into the network in advance, through anonymous nodes, and spread further on their own. The operators needed no servers registered in their name, no hosting paid for with bank cards, no connection logs.
By mid-2008 the size of the Storm botnet had shrunk to around 85,000 machines, according to several research groups. That was a radical drop compared to the peak of 2007, when the count was in the hundreds of thousands or more. Reasons for the decline: mass cleaning of machines through MSRT and other antivirus updates, blocking of spam mailings at the provider level, shutdown of domains used in Fast Flux DNS. The P2P architecture proved resilient, but not invulnerable.
Its technologies formed the basis for the next P2P botnets: Waledac, which appeared in late 2008 and used a similar architecture, and Gameover Zeus, which dominated in 2011–2014 and used P2P to protect a banking Trojan. The lesson of Storm: a central server is a weak spot, P2P is expensive but effective protection.
But the main question remained unanswered. Who created Storm? Why were the operators never found, even though the botnet attracted the attention of researchers, law enforcement, intelligence services? Perhaps the trail went cold in the distributed architecture, where each node knew only its neighbors. Perhaps the operators left before anyone got close enough. Or perhaps someone decided not to take the case to court, preferring quiet observation to a loud capture. The story of Storm did not end with arrests and press releases, but with the gradual fading of the network, as if the operators had simply switched to the next project, leaving behind only code, traffic, and millions of letters about catastrophes that never happened.