Storm-0501 hackers shift to ransomware attacks in the cloud

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

Microsoft warns that a threat actor tracked as Storm-0501 has evolved its operations, shifting away from encrypting devices with ransomware to focusing on cloud-based encryption, data theft, and extortion. The hackers now abuse native cloud features to exfiltrate data, wipe backups, and destroy storage accounts, thereby applying pressure and extorting victims without deploying traditional ransomware encryption tools. Storm-0501 is a threat actor who has been active since at least 2021, deploying the Sabbath ransomware in attacks against organizations worldwide. Over time, the threat actor joined various ransomware-as-a-service (RaaS) platforms, where they used encryptors from Hive, BlackCat (ALPHV), Hunters International, LockBit, and, more recently, Embargo ransomware. In September 2024, Microsoft detailed how Storm-0501 extended its operations into hybrid cloud environments, pivoting from compromising Active Directory to Entra ID tenants. During these attacks, the threat actors either created persistent backdoors through malicious federated domains or encrypted on-premises devices using ransomware, such as Embargo. A new report by Microsoft today outlines a shift in tactics, with Storm-0501 no longer relying on on-premises encryption and instead conducting attacks purely in the cloud. "Unlike traditional on-premises ransomware, where the threat actor typically deploys malware to encrypt critical files across endpoints within the compromised network and then negotiates for a decryption key, cloud-based ransomware introduces a fundamental shift," reads the report by Microsoft Threat Intelligence. "Leveraging cloud-native capabilities, Storm-0501 rapidly exfiltrates large volumes of data, destroys data and backups within the victim environment, and demands ransom—all without relying on traditional malware deployment." Cloud-based ransomware attacks In recent attacks observed by Microsoft, the hackers compromised multiple Active Directory domains and Entra tenants by exploiting gaps in Microsoft Defender deployments. Storm-0501 then used stolen Directory Synchronization Accounts (DSAs) to enumerate users, roles, and Azure resources with tools such as AzureHound. The attackers eventually discovered a Global Administrator account that lacked multifactor authentication, allowing them to reset its password and gain complete administrative control. With these privileges, they established persistence by adding malicious federated domains under their control, enabling them to impersonate almost any user and bypass MFA protections in the domain. Microsoft says they escalated their access further into Azure by abusing the Microsoft.Authorization/elevateAccess/action, which allowed them to ultimately assign themselves to Owner roles, effectively taking over the victim's entire Azure environment. Once in control of the cloud environment, Storm-0501 began disabling defenses and stealing sensitive data from Azure Storage accounts. The threat actors also attempted to destroy storage snapshots, restore points, Recovery Services vaults, and storage accounts to prevent the target from recovering data for free. When the threat actor couldn't delete data from recovery services, they utilized cloud-based encryption by creating new Key Vaults and customer-managed keys, effectively encrypting the data with new keys and making it inaccessible to the company unless they pay a ransom. After stealing data, destroying backups, or encrypting cloud data, Storm-0501 moved to the extortion phase, contacting victims through Microsoft Teams using compromised accounts to deliver ransom demands. Microsoft's report shares protection advice, Microsoft Defender XDR detections, and hunting queries that can help find and detect the tactics used by this threat actor. As ransomware encryptors are increasingly blocked before they can encrypt devices, we may see other threat actors shift away from on-premise encryption to cloud-based data theft and encryption, which may be harder to detect and block. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

The financially motivated threat actor known as Storm-0501 has been observed refining its tactics to conduct data exfiltration and extortion attacks targeting cloud environments. "Unlike traditional on-premises ransomware, where the threat actor typically deploys malware to encrypt critical files across endpoints within the compromised network and then negotiates for a decryption key, cloud-based ransomware introduces a fundamental shift," the Microsoft Threat Intelligence team said in a report shared with The Hacker News. "Leveraging cloud-native capabilities, Storm-0501 rapidly exfiltrates large volumes of data, destroys data and backups within the victim environment, and demands ransom -- all without relying on traditional malware deployment." Storm-0501 was first documented by Microsoft almost a year ago, detailing its hybrid cloud ransomware attacks targeting government, manufacturing, transportation, and law enforcement sectors in the U.S., with the threat actors pivoting from on-premises to cloud for subsequent data exfiltration, credential theft, and ransomware deployment. The Windows maker told The Hacker News the latest wave of attacks targeting is opportunistic and not sector-specific, and that multiple organizations including schools, healthcare, and other entities have been attacked by the e-crime crew. Assessed to be active since 2021, the hacking group has evolved into a ransomware-as-a-service (RaaS) affiliate delivering various ransomware payloads over the years, such as Sabbath, Hive, BlackCat (ALPHV), Hunters International, LockBit, and Embargo. "Storm-0501 has continued to demonstrate proficiency in moving between on-premises and cloud environments, exemplifying how threat actors adapt as hybrid cloud adoption grows," the company said. "They hunt for unmanaged devices and security gaps in hybrid cloud environments to evade detection and escalate cloud privileges and, in some cases, traverse tenants in multi-tenant setups to achieve their goals." Typical attack chains involve the threat actor abusing their initial access to achieve privilege escalation to a domain administrator, followed by on-premises lateral movement and reconnaissance steps that allow the attackers to breach the target's cloud environment, thereby initiating a multi-stage sequence involving persistence, privilege escalation, data exfiltration, encryption, and extortion. Initial access, per Microsoft, is achieved through intrusions facilitated by access brokers like Storm-0249 and Storm-0900, taking advantage of stolen, compromised credentials to sign in to the target system, or exploiting various known remote code execution vulnerabilities in unpatched public-facing servers. "Access brokers typically sell or provide footholds into organizations, which ransomware operators then use to launch their attacks," Sherrod DeGrippo, Director of Threat Intelligence Strategy at Microsoft, said. "In the past, Storm-0501 and its affiliates have exploited known remote code execution vulnerabilities in unpatched, internet-facing servers, including products like Zoho ManageEngine, Citrix NetScaler, and Adobe ColdFusion 2016. By targeting these vulnerabilities, threat actors can bypass perimeter defenses and establish a presence inside the network, setting the stage for further compromise and ransomware deployment." In a recent campaign targeting an unnamed large enterprise with multiple subsidiaries, Storm-0501 is said to have conducted reconnaissance before laterally moving across the network using Evil-WinRM. The attackers also carried out what's called a DCSync Attack to extract credentials from Active Directory by simulating the behavior of a domain controller. "Leveraging their foothold in the Active Directory environment, they traversed between Active Directory domains and eventually moved laterally to compromise a second Entra Connect server associated with a different Entra ID tenant and Active Directory domain," Microsoft said. "The threat actor extracted the Directory Synchronization Account to repeat the reconnaissance process, this time targeting identities and resources in the second tenant." These efforts ultimately enabled Storm-0501 to identify a non-human synced identity with a Global Admin role in Microsoft Entra ID on that tenant, and lacking in multi-factor authentication (MFA) protections. This subsequently opened the door to a scenario where the attackers reset the user's on-premises password, causing it to be synced to the cloud identity of that user using the Entra Connect Sync service. Armed with the compromised Global Admin account, the digital intruders have been found to access the Azure Portal, registering a threat actor-owned Entra ID tenant as a trusted federated domain to create a backdoor, and then elevate their access to critical Azure resources, before setting the stage for data exfiltration and extortion. "After completing the exfiltration phase, Storm-0501 initiated the mass-deletion of the Azure resources containing the victim organization data, preventing the victim from taking remediation and mitigation action by restoring the data," Microsoft said. "After successfully exfiltrating and destroying the data within the Azure environment, the threat actor initiated the extortion phase, where they contacted the victims using Microsoft Teams using one of the previously compromised users, demanding ransom." The company said it has enacted a change in Microsoft Entra ID that prevents threat actors from abusing Directory Synchronization Accounts to escalate privileges. It has also released updates to Microsoft Entra Connect (version 2.5.3.0) to support Modern Authentication to allow customers to configure application-based authentication for enhanced security. "It is also important to enable Trusted Platform Module (TPM) on the Entra Connect Sync server to securely store sensitive credentials and cryptographic keys, mitigating Storm-0501’s credential extraction techniques," the tech giant added. (The story was updated after publication to include responses from Microsoft.)

Storm-0501, a financially motivated cybercrime crew, recently broke into a large enterprise's on-premises and cloud environments, ultimately exfiltrating and destroying data within the org's Azure environment. The criminals then contacted the victim via a Microsoft Teams account that they'd also compromised in the attack, demanding a ransom payment for the stolen files. This attack, according to Microsoft's threat intelligence team, illustrates a scary shift in ransomware tactics, which are moving away from traditional endpoint-based attacks and toward cloud-based ransomware. "Leveraging cloud-native capabilities, Storm-0501 rapidly exfiltrates large volumes of data, destroys data and backups within the victim environment, and demands ransom — all without relying on traditional malware deployment," Redmond wrote in Wednesday report shared with The Register. "Storm" is the naming convention Microsoft uses for emerging threat groups, and in September 2024 the Windows giant detailed how Storm-0501 extended its on-premises ransomware operations into hybrid cloud environments. In these earlier attacks, the crew compromised Active Directory environments and then pivoted to Microsoft Entra ID, escalating privileges on hybrid and cloud identities to gain global admin-level privileges before implanting backdoors and, in some cases, deploying ransomware. In the more recent attack, Storm-0501 again escalated privileges and abused identities across the compromised environment to jump from on-premises to cloud. The victim company had multiple subsidiaries, and each operated its own Active Directory domain, configured to allow for cross-domain authentication and resource access. The subsidiaries also had separate Azure tenants, each with different Microsoft Defender protections enabled. "Notably, only one tenant had Microsoft Defender for Endpoint deployed, and devices from multiple Active Directory domains were onboarded to this single tenant's license," the threat intel team wrote. That was one of the visibility gaps. Additionally, the Active Directory domains were synced to several Entra ID tenants using Entra Connect Sync servers, and in some cases one domain was synced to more than one tenant, making identity management a difficult task. From on-premises… In the on-premises part of the attack, the criminals checked the endpoints for Defender and then compromised an Entra Connect Sync server that was not using the endpoint security product. "We assess that this server served as a pivot point, with the threat actor establishing a tunnel to move laterally within the network," Microsoft said. For this lateral movement, the crew used Evil-WinRM, a post-exploitation tool that abuses PowerShell over Windows Remote Management (WinRM) for remote code execution. They also used a DCSync attack, which is a credential-dumping technique that allows an attacker to impersonate a domain controller by abusing the Directory Replication Service Remote Protocol and, in this role, retrieve sensitive Active Directory data, such as password hashes for any user in the domain. Using these stolen credentials, the intruders attempted to sign in as several privileged users but were ultimately blocked because the accounts had multi-factor authentication (MFA). So they went back to Active Directory and compromised a second Entra Connect server linked to a different Entra ID tenant and Active Directory domain, again initiating a DCSync attack. This time around, Storm-0501 was able to identify a non-human synced identity assigned a global admin role in Microsoft Entra ID on that tenant. And this one didn't have MFA turned on. To Azure The digital thieves next reset the user's on-prem password, which synced (via Entra Connect Sync) to the cloud ID of that user. The attackers then registered a new, attacker-controlled MFA method, and used this account to move laterally between different devices in the network, finally finding a hybrid-joined server that allowed them to sign in to the Azure portal using the global admin account. "From the point that the threat actor was able to successfully meet the Conditional Access policies and sign in to the Azure portal as a Global Admin account, Storm-0501 essentially achieved full control over the cloud domain," Redmond said. "The threat actor then utilized the highest possible cloud privileges to obtain their goals in the cloud." These goals included first registering a threat actor-owned Entra ID tenant as a trusted federated domain, which essentially created a backdoor for Storm-0501 to use for persistent access. "The backdoor enabled Storm-0501 to craft security assertion markup language (SAML) tokens applicable to the victim tenant, impersonating users in the victim tenant while assuming the impersonated user's Microsoft Entra roles," the threat hunters explained. The tenant's Entra ID and Azure environments are connected, and the attackers already had top-level Entra ID Privileges. After invoking the Microsoft.Authorization/elevateAccess/action operation using the compromised Microsoft Entra global administrator account, Storm-0501 achieved a User Access Administrator Azure role and this allowed access to all of the enterprise's Azure subscriptions and data stored therein. For data theft and beyond From here, they stole and deleted a bunch of data, and then extorted the victim for a ransom payment, contacting them via a compromised Teams account. How to protect yourself Luckily, Microsoft also suggests several mitigation measures that organizations can take to prevent becoming another one of Storm-0501's cloud ransomware victims. Redmond recently made a change in Microsoft Entra ID that aims to prevent attackers from abusing Directory Synchronization Accounts in attacks to escalate privileges, plus a new May version in public preview allows customers to configure application-based authentication. The tech company also urges customers to enable Trusted Platform Module (TPM) on the Entra Connect Sync server to store sensitive credentials and cryptographic keys, thus preventing those from being stolen. There's also a list of steps to take to protect both on-premises environments and cloud identities, so be sure to check out all of them. And here are a few key ones to protect cloud-based identities: practice principle of least privilege to ensure that users and applications are only granted minimum permissions needed to perform specific tasks, enforce conditional access policies that are enforced every time a user tried to sign in to an account, and — please, please, please — require MFA for all users.