Storm-0501 Hits Enterprise With 'Cloud-Based Ransomware' Attack

Storm-0501 Hits Enterprise With undefinedCloud-Based Ransomwareundefined Attack reports that Microsoft published on August 27 a study of Storm-0501, a ransomware actor active since 2021 that has used a range of ransomware-as-a-service strains including Embargo, Hunters International, Hive, BlackCat/ALPHV, and LockBit.

According to Microsoft, Storm-0501 has shifted toward cloud-based attacks that exploit victim environments’ native capabilities rather than malware, enabling rapid exfiltration of data before backups can be destroyed. The research describes a recent operation in which the threat actor gained cloud privilege escalation, leveraged gaps in protection and visibility, and moved from on-premises to cloud pivots across multiple Azure tenants.

The group compromised devices not connected to Defender, obtained domain administrator privileges, and used a post-exploitation tool for remote code execution and lateral movement, before finally leveraging a backdoor and cloud resources to extend control and exfiltrate data. Microsoft notes that MFA could not be bypassed in this case, and the attacker pivoted between Entra ID tenants to target a second tenant, demonstrating extensive cross-tenant movement.

Storm-0501 even attempted cloud-based encryption via a new Azure Key Vault and customer-managed keys, though Azure Key Vault’s soft-delete feature protected the keys for 90 days. The firm also describes how the threat actor demanded a ransom after contacting the victim through Microsoft Teams, while defenders are urged to tighten least-privilege policies, MFA, and conditional access across cloud identities.