Ransomware Group Exploits Hybrid Cloud Gaps, Gains Full Azure Control in Enterprise Attacks

Storm-0501, a financially motivated threat actor, has been active since at least 2021 and now focuses on cloud environments for data theft and extortion, according to Microsoft. The group has used ransomware families such as Sabbath, Alphv/BlackCat, Hive, Hunters International, LockBit and Embargo in on‑premises and hybrid cloud attacks, and has moved from compromising Active Directory to Entra ID, escalating to global administrator and implanting backdoors in Entra ID tenant configurations.

In a recent enterprise attack, Storm-0501 compromised multiple Active Directory domains, enumerated endpoints and Azure resources, and later gained access to the Azure portal as a global admin after locating a Microsoft Entra hybrid joined device, deploying a backdoor to sign in as any user and registering a new Entra ID tenant.

Armed with top‑level Entra ID privileges, the attackers then assumed the Owner role over all Azure subscriptions, enabling data exfiltration via the AzCopy CLI and followed by mass deletion and cloud‑based encryption to hinder remediation. They allegedly used cloud‑native commands for reconnaissance, lateral movement and credential exfiltration, and staged an extortion phase via Microsoft Teams.