Microsoft has issued an urgent warning about the cybercriminal group known as Storm-0501.

This financially motivated gang has been active since 2021, initially targeting U.S. schools with the Sabbath ransomware.

Now, Storm-0501 operates as a ransomware-as-a-service (RaaS) affiliate, deploying notorious ransomware families like Alphv/BlackCat and LockBit.

Recent intelligence indicates that they are specifically targeting hybrid cloud environments across various U.S. sectors, including government and transportation.

Storm-0501 employs a multi-stage attack strategy, moving laterally from on-premises systems to cloud infrastructures.

This tactic allows them to establish persistent backdoor access while stealing sensitive credentials and data.

Microsoft emphasizes that weak credentials and over-privileged accounts are prime vulnerabilities exploited by this group.

Access brokers facilitate initial breaches, often leveraging known vulnerabilities in systems like Citrix NetScaler and Zoho ManageEngine.

Once inside, Storm-0501 escalates privileges, conducts reconnaissance, and deploys remote monitoring tools to further infiltrate networks.

In a recent campaign, they used Microsoft Entra ID credentials to create a new federated domain, ensuring ongoing access.

Ultimately, after gaining extensive control, Storm-0501 has been seen deploying Embargo ransomware across compromised networks.

Organizations must prioritize enhanced cybersecurity measures to protect against this evolving threat.