Storm-0501

· ATT&CK GroupG1053

Techniques

Software

Tactics

Aliases

Description

Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.(Citation: Avertium Storm-0501 Sabbath Ransomware Arcane January 2022)(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)(Citation: Google Mandiant Storm-0501 Sabbath Ransomware November 2021)

Tactic Coverage

discovery (9)credential access (7)privilege escalation (6)stealth (5)persistence (5)defense impairment (4)impact (4)execution (3)lateral movement (2)initial access (2)exfiltration (2)resource development (2)command and control (1)collection (1)

Techniques Used (42)

T1003OS Credential Dumping

credential access

T1003.006DCSync

credential access

T1021.006Windows Remote Management

lateral movement

T1021.007Cloud Services

lateral movement

T1027.002Software Packing

stealth

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 42 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (8)

S0677AADInternalstool S0154Cobalt Strikemalware S1247Embargomalware S0357Impackettool S0039Nettool S0359Nltesttool S1040Rclonetool S0057Tasklist

References (5)

https://attack.mitre.org/groups/G1053 https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/