MITRE ATT&CKgroup
G1053 Storm-0501
- Domain
- enterprise
- Version
- 1.0
- Created
- 2025-10-19
Description
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.
Related
Uses · MITRE ATT&CK (50)
- S1247 Embargo software (malware)
- T1219.002 Remote Desktop Software sub-technique
- T1556.009 Conditional Access Policies sub-technique
- T1555.006 Cloud Secrets Management Stores sub-technique
- T1657 Financial Theft technique
- T1021.007 Cloud Services sub-technique
- S1040 Rclone software (tool)
- T1059.009 Cloud API sub-technique
- S0677 AADInternals software (tool)
- T1614.001 System Language Discovery sub-technique
- T1555.005 Password Managers sub-technique
- T1484.001 Group Policy Modification sub-technique
- T1484.002 Trust Modification sub-technique
- T1588.006 Vulnerabilities sub-technique
- T1587.003 Digital Certificates sub-technique
- T1580 Cloud Infrastructure Discovery technique
- T1578.003 Delete Cloud Instance sub-technique
- T1078.004 Cloud Accounts sub-technique
- T1059.001 PowerShell sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1087.002 Domain Account sub-technique
- T1087.004 Cloud Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1003.006 DCSync sub-technique
- T1021.006 Windows Remote Management sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1027.002 Software Packing sub-technique
- T1552.004 Private Keys sub-technique
- T1218.010 Regsvr32 sub-technique
- T1218.011 Rundll32 sub-technique
References
- https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang Avertium Storm-0501 Sabbath Ransomware Arcane January 2022
- https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/ Microsoft Storm-501 Sabbath Ransomware Embargo September 2024
- https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/ Microsoft Storm-0501 Embargo Ransomware August 2025
- https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/ Google Mandiant Storm-0501 Sabbath Ransomware November 2021