Malware-less Ransomware: How Storm-0501 is Pivoting to Cloud-Native Attacks

According to Microsoft Threat Intelligence, Storm-0501, a financially motivated threat actor, has dramatically shifted its ransomware operations from on‑premises to cloud‑native campaigns, a move first observed in 2021 with Sabbath ransomware against U.S. school districts and later in 2023 targeting the healthcare sector, with Embargo in 2024.

The latest investigation traces the group’s attack chain across a multi-subsidiary enterprise with complex Active Directory and Azure environments, beginning with an on‑premises foothold where domain admin rights were gained and tools like Evil-WinRM were used for lateral movement, including a DCSync attack to extract password hashes.

In the pivot to the cloud, Storm-0501 used compromised Entra Connect Sync servers to enumerate cloud resources with AzureHound, exploited a non-human synced identity with Global Administrator rights and no MFA, and escalated by resetting its on‑premises password to achieve full cloud control.

The group established persistence by adding federated domains into Entra ID to impersonate nearly any user with crafted SAML tokens, and, with Global Admin access, moved to User Access Administrator and Owner roles across all Azure subscriptions, mapping storage and backup resources.

They abused legitimate Azure operations to exfiltrate data with AzCopy, delete backups and storage accounts, and attempt cloud-based encryption via new Key Vaults and encryption scopes, as Microsoft summarises that cloud-based ransomware enables rapid exfiltration, destruction of data and backups, and ransom demands. In a final twist, Storm-0501 used Microsoft Teams to contact victims during the extortion phase.