Loading threat actor…
Storm-0501 is a financially motivated cybercriminal threat actor active since 2021 that conducts ransomware and data-extortion operations. It is a publicly tracked affiliate of the Embargo ransomware-as-a-service operation, rather than a synonymous name for the entire operation. Its ransomware deployment history also includes Sabbath, Hive, BlackCat, Hunters International, and LockBit 3.0. Storm-0501 gains initial access through exploitation of known vulnerabilities in internet-facing applications and abuse of compromised credentials. Exploited vulnerabilities include CVE-2022-47966 in Zoho ManageEngine, CVE-2023-4966 in Citrix NetScaler, and CVE-2023-29300 and CVE-2023-38203 in Adobe ColdFusion. Following compromise, it conducts Active Directory and host reconnaissance, steals credentials using techniques including DCSync and tools such as Impacket SecretsDump, and performs brute-force activity. Its operational toolkit includes ADRecon, AzureHound, Cobalt Strike, Evil-WinRM, and legitimate remote-management software. It uses privileged access and Windows remote-administration mechanisms for lateral movement and ransomware deployment, including distribution through Group Policy scheduled tasks. The actor has expanded from on-premises intrusions into hybrid Microsoft environments by compromising Entra Connect Sync accounts and abusing cloud-privileged identities. Its cloud operations include resetting privileged-account passwords, registering attacker-controlled multifactor authentication methods, establishing federated-domain backdoors with AADInternals, and accessing Azure Key Vault secrets and storage account keys. These activities support persistent access and theft of cloud-hosted data. Storm-0501 uses Rclone, MegaSync, and AzCopy for data exfiltration, including cloud-to-cloud transfers. Its ransomware operations combine data theft with encryption to pressure victims into paying, while its use of legitimate administration tools and cloud services helps conceal malicious activity within authorized enterprise workflows.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
121 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
22 malware families Mallory has associated with this actor across public reporting.
17 additional families tracked in Mallory.
13 CVEs Mallory has associated with this actor across public reporting. 13 of them are exploited in the wild (not necessarily by this actor).
7 more CVEs tied to this actor tracked in Mallory.
4 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.