Storm-0501’s Shift to Cloud-Native Ransomware

Storm-0501: Cloud-Native Ransomware Campaign Targeting Hybrid Environments

Summary

Storm-0501 is a financially motivated threat actor active since 2021 that has evolved from traditional ransomware to cloud-native ransomware operations. Initially known for deploying Sabbath ransomware against U.S. school districts, the group expanded into the healthcare sector with BlackCat and Hunters International variants, later shifting to Embargo ransomware campaigns. By late 2024, Storm-0501 began exploiting hybrid cloud environments by abusing Active Directory (AD) to Entra ID trust relationships. In 2025, the group adopted cloud-native ransomware techniques, exfiltrating and deleting data directly via cloud services, bypassing traditional endpoint defenses. Targeted industries include critical infrastructure, government, law enforcement, energy, aerospace, defense, healthcare, financial services, agriculture, media, and consumer goods.

Attack Details

Storm-0501’s attacks often begin with the compromise of an on-premises Active Directory domain through privilege escalation and credential theft. After achieving domain administrator access, they pivot into cloud environments by abusing Entra Connect Sync accounts to enumerate users and hijack privileged identities.

Key techniques include:

• Password resets and MFA manipulation – Registering new MFA methods for persistence.

• Global admin privilege escalation – Expanding reach across Azure subscriptions.

• Cloud data destruction – Exfiltrating, deleting, or encrypting data from Azure storage accounts and Key Vaults.

• Ransom delivery via collaboration tools – Using compromised Microsoft Teams accounts to enforce ransom demands.

This cloud-centric approach enables Storm-0501 to cripple cloud environments, bypass traditional malware detection, and enforce extortion through data exfiltration and deletion.

Recommendations

1. On-Premises Protection – Enable tamper protection and deploy EDR in block and remediation modes. Patch enterprise tools like Zoho ManageEngine and monitor privileged accounts for abuse.

2. Cloud Identity Security – Enforce MFA with phishing-resistant methods, apply Conditional Access policies, restrict Directory Sync account permissions, and enforce least privilege across all cloud identities.

3. Cloud Resource Safeguards – Use Microsoft Defender for Cloud to monitor resources. Enable resource locks, immutable storage, and purge protection for Key Vaults. Secure storage with private endpoints and backup solutions.

4. General Hygiene & Monitoring – Adopt exposure management, monitor authentication anomalies, train users to spot phishing, enforce strong password policies, and maintain robust backup strategies.

Indicators of Compromise (IoCs)

• SHA256 Hashes (samples):

  • efb2f6452d7b0a63f6f2f4d8db49433259249df598391dd79f64df1ee3880a8d

  • a9aeb861817f3e4e74134622cbe298909e28d0fcc1e72f179a32adc637293a40

  • caa21a8f13a0b77ff5808ad7725ff3af9b74ce5b67426c84538b8fa43820a031

  • d37dc37fdcebbe0d265b8afad24198998ae8c3b2c6603a9258200ea8a1bd7b4a

  • 53e2dec3e16a0ff000a8c8c279eeeca8b4437edb8ec8462bfbd9f64ded8072d9

(full IoC list in advisory)

MITRE ATT&CK TTPs

• Tactics: Initial Access (TA0001), Execution (TA0002), Persistence (TA0003), Privilege Escalation (TA0004), Defense Evasion (TA0005), Credential Access (TA0006), Discovery (TA0007), Lateral Movement (TA0008), Collection (TA0009), Exfiltration (TA0010), Command and Control (TA0011), Impact (TA0040).

• Techniques:

  • Exfiltration to Cloud Storage (T1567.002), Data Encrypted for Impact (T1486), Data Destruction (T1485)

  • Domain Policy & Trust Modification (T1484, T1484.002)

  • Access Token Manipulation (T1134, T1134.002)

  • OS Credential Dumping (T1003.006), DCSync (T1003)

  • Cloud API Abuse (T1059.009), PowerShell Execution (T1059.001)

  • External Remote Services (T1133), Valid Accounts (T1078, T1078.004), Cloud Account Manipulation (T1098, T1098.003)

References

• Microsoft – Storm-0501 Cloud Ransomware Techniques

• Cyble – Storm-0501 Threat Actor Profile