2007 · Security

The Storm worm: the botnet that started with a weather headline

Last reviewed 5 October 2026

In January 2007 an email about deadly storms in Europe spread a Trojan that built one of the largest peer-to-peer botnets of its time.

How it began

In January 2007, as a severe windstorm hit Europe, inboxes filled with messages carrying headlines about storm deaths. The attachment was a Trojan for Windows. The timely subject line gave the malware its name.

Later waves used whatever was topical: e-cards, news alerts, holiday greetings and fake video links. The lures changed constantly, which made simple subject-line filtering ineffective.

Why it was different

Earlier mass-mailing worms were mostly about spreading. Storm was about building a resilient botnet. Infected machines communicated over a peer-to-peer network rather than a single control server, which made it much harder to shut down.

The network was rented out for spam and used for distributed denial-of-service attacks, including against researchers who probed it. Estimates of its size varied enormously, from hundreds of thousands to millions of machines, because a peer-to-peer botnet is hard to count.

Decline

By late 2007 researchers reported that Storm’s active population was shrinking, helped by antivirus updates and Microsoft’s Malicious Software Removal Tool. Its operators were never publicly identified. Its peer-to-peer design and fast-changing lures influenced the botnets that followed.