Storm-0501 hackers shift to ransomware attacks in the cloud

Microsoft warns that the storm-0501 threat actor has evolved its operations from encrypting devices to cloud-based encryption, data theft and extortion, abusing native cloud features to exfiltrate data, wipe backups and destroy storage accounts. The group, active since at least 2021 and once deploying Sabbath ransomware, has since joined multiple ransomware-as-a-service platforms and used encryptors from Hive, BlackCat (ALPHV), Hunters International, LockBit, and Embargo.

In September 2024, Microsoft detailed how Storm-0501 extended into hybrid cloud environments, pivoting from compromising Active Directory to Entra ID tenants, sometimes creating persistent backdoors or encrypting on‑premises devices with Embargo.

According to Microsoft Threat Intelligence, Storm-0501 no longer relies on on‑premises encryption and conducts attacks purely in the cloud, leveraging cloud-native capabilities to rapidly exfiltrate data, destroy backups, encrypt data with new keys in Key Vaults, and demand ransom without traditional malware deployment. The attackers have also been seen disabling defenses and later contacting victims via compromised Microsoft Teams accounts to deliver ransom demands.