Microsoft Flags Storm-0501 as a Significant Threat in Hybrid Cloud Ransomware Attacks

27.09.2024

Storm-0501 has been actively targeting critical sectors in the U.S., including government, manufacturing, transportation, and law enforcement, to carry out sophisticated ransomware attacks. This threat actor’s multi-stage campaign aims to compromise hybrid cloud environments, facilitating lateral movement between on-premises and cloud systems. The ultimate goal of these attacks is to steal data, obtain credentials, establish persistent access, and deploy ransomware to extort victims.

Microsoft has identified Storm-0501 as a financially motivated cybercriminal group known for using both commodity and open-source tools to conduct their operations. Active since 2021, this group originally focused on education sectors with Sabbath (54bb47h) ransomware before expanding into a ransomware-as-a-service (RaaS) model. Through this model, they have delivered numerous ransomware strains over the years, including Hive, BlackCat (ALPHV), Hunters International, LockBit, and most recently, Embargo.

A defining characteristic of Storm-0501’s attack strategy is the exploitation of weak credentials and over-privileged accounts, enabling them to move from on-premises systems to cloud infrastructures. They often gain initial access through brokers like Storm-0249 and Storm-0900 or by exploiting known vulnerabilities in unpatched servers, such as Zoho ManageEngine, Citrix NetScaler, and Adobe ColdFusion 2016. Once inside, they conduct reconnaissance to identify high-value assets and gain deeper control over the network.

Storm-0501 typically uses advanced tools like Cobalt Strike for lateral movement across the network, as well as Impacket’s SecretsDump to extract credentials from a wide range of devices. Afterward, they exfiltrate data to public cloud storage services like MegaSync, often using Rclone. In addition, they establish persistent backdoor access to maintain control over both on-premises and cloud systems, setting the stage for ransomware deployment.

The attack concludes with the deployment of Embargo, a Rust-based ransomware first discovered in 2024, used to encrypt files and threaten victims with data leaks unless a ransom is paid. Operating under the RaaS model, Storm-0501 and its affiliates leverage Embargo’s platform for these double extortion tactics, targeting victims who fail to meet ransom demands by threatening to expose sensitive data.