Threat actor
Storm-0501
financial
Tracked by CyberSIXT since 27 Aug 2025
- Articles · all time
- 6
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 0
6 articles from 6 outlets since 27 Aug 2025; the latest 423 days ago.
- Article
Show as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Fri 29 Aug 2025 · 01:30 UTC | SecurityOnline | Malware-less Ransomware: How Storm-0501 is Pivoting to Cloud-Native Attacks |
| Thu 28 Aug 2025 · 10:16 UTC | GBHackers | Microsoft Unveils Storm-0501’s Cloud-Based Ransomware Deployment Tactics |
| Wed 27 Aug 2025 · 23:45 UTC | BleepingComputer | Storm-0501 hackers shift to ransomware attacks in the cloud |
| Wed 27 Aug 2025 · 20:09 UTC | The Hacker News | Storm-0501 Exploits Entra ID to Exfiltrate and Delete Azure Data in Hybrid Cloud Attacks |
| Wed 27 Aug 2025 · 18:09 UTC | Microsoft | Storm-0501’s evolving techniques lead to cloud-based ransomware |
| Wed 27 Aug 2025 · 18:09 UTC | Dark Reading | Storm-0501 Hits Enterprise With 'Cloud-Based Ransomware' Attack |
Who reported 6 outlets
- Dark Reading1
- Microsoft1
- The Hacker News1
- BleepingComputer1
- GBHackers1
- SecurityOnline1
Names and sources
- Storm-0501
- Named by CyberSIXT coverage
- Storm-0501
- Named by Malpedia · storm-0501
- Storm-0501
- Named by Microsoft · Storm-0501
- Storm-0501
- Named by MISP Galaxy · f6a60403-4bcc-4fc6-ac07-abb913c1f080
- Storm-0501
- Named by MITRE ATT&CK® · G1053
- f6a60403-4bcc-4fc6-ac07-abb913c1f080
- Named by CyberSIXT coverage
Attributed facts
- category
- financial (Microsoft · Storm-0501)
- motivation
- financial (Microsoft · Storm-0501)
Malware and tools
Net (MITRE ATT&CK® · G1053) Tasklist (MITRE ATT&CK® · G1053) Cobalt Strike (MITRE ATT&CK® · G1053) Impacket (MITRE ATT&CK® · G1053) Nltest (MITRE ATT&CK® · G1053) AADInternals (MITRE ATT&CK® · G1053) Rclone (MITRE ATT&CK® · G1053) Embargo (MITRE ATT&CK® · G1053) Hunters International (Malpedia · storm-0501)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G1053
Tactics pending refresh
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- Malware-less Ransomware: How Storm-0501 is Pivoting to Cloud-Native AttacksSecurityOnline
- Microsoft Unveils Storm-0501’s Cloud-Based Ransomware Deployment TacticsGBHackers
- Storm-0501 hackers shift to ransomware attacks in the cloudBleepingComputer
- Storm-0501 Exploits Entra ID to Exfiltrate and Delete Azure Data in Hybrid Cloud AttacksThe Hacker News
- Storm-0501’s evolving techniques lead to cloud-based ransomwareMicrosoft
- Storm-0501 Hits Enterprise With 'Cloud-Based Ransomware' AttackDark Reading · first in our coverage