Storm-0501’s evolving techniques lead to cloud-based ransomware

According to Microsoft Threat Intelligence, Storm-0501, a financially motivated threat actor, has continuously evolved campaigns to focus on cloud-based ransomware tactics, shifting from on-premises endpoint encryption to rapid data exfiltration and destruction in cloud environments. The group’s activity began with Sabbath ransomware in attacks on United States school districts in 2021 and later targeted the healthcare sector in November 2023, before switching ransomware payloads to Embargo in 2024.

The blog details how Storm-0501 pivoted from on‑premises to cloud by compromising Active Directory and Entra ID, escalating privileges to gain global administrator access, and then leveraging cloud capabilities to exfiltrate data, delete backups, and demand ransom. A key progression involved establishing a cloud persistence backdoor via a federated domain, enabling sign-ins as almost any user, and bypassing Conditional Access by registering a new MFA method under the actor’s control.

In the cloud, the attacker elevated to Azure roles, conducted extensive discovery with AzureHound, and ultimately mass-deleted Azure data stores or encrypted data with a mitigated approach due to Azure Key Vault soft-delete protections. The report also highlights mitigation measures, including restricting Directory Synchronization Accounts, enforcing MFA, and using Defender and Cloud tools to detect and respond to hybrid cloud threats.