Storm-0506

Storm-0506 is a financially motivated ransomware operator tracked by Microsoft and associated with Black Basta ransomware deployment. The actor has been observed in post-compromise operations that escalate from initial access obtained by other malware or access brokers into enterprise-wide ransomware impact, including attacks against VMware ESXi environments. Documented Storm-0506 activity includes a North American engineering-sector intrusion in which initial access followed a Qakbot infection. In that case, the actor exploited CVE-2023-28252 for privilege escalation, used Cobalt Strike and Pypykatz to steal domain administrator credentials, moved laterally to domain controllers, established persistence with custom tooling and SystemBC, attempted RDP brute force against additional systems, and then abused CVE-2024-37085 by creating an "ESX Admins" Active Directory group to obtain administrative control of domain-joined ESXi hosts. The intrusion culminated in encryption of the ESXi file system, disruption of hosted virtual machines, and additional encryption activity on non-ESXi systems using PsExec. Storm-0506 has also been linked to ransomware deployments following access-broker activity involving malicious MSIX/App Installer delivery chains. In one observed sequence, BATLOADER infections led to Cobalt Strike, data exfiltration with Rclone, and subsequent Black Basta deployment by Storm-0506. Microsoft has further identified Storm-0506 among ransomware operators exploiting the ESXi privilege model weakness tracked as CVE-2024-37085, alongside other actors deploying Akira and Black Basta. The actor’s observed tradecraft supports a mature human-operated ransomware workflow centered on credential theft, privilege escalation, lateral movement, persistence, post-exploitation, data exfiltration, and encryption-driven extortion. Storm-0506 is best understood as a cybercriminal ransomware actor rather than a state-sponsored espionage group.