Storm-0501
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.
- ATT&CK ID
- G1053
- Weather family
- Storm
- Techniques
- 34
- Tools
- 8
Vulnerabilities it has exploited
- CVE-2022-47966 Zoho ManageEngineUnscored · exploited in the wild
- CVE-2023-29300 Adobe ColdFusionUnscored · exploited in the wild
- CVE-2023-38203 Adobe ColdFusionUnscored · exploited in the wild
- CVE-2023-4966 Citrix NetScaler ADC and NetScaler GatewayUnscored · exploited in the wild
Techniques
Resource Development
Develop CapabilitiesObtain Capabilities
Initial Access
Valid AccountsExploit Public-Facing Application
Execution
Scheduled Task/JobCommand and Scripting Interpreter
Persistence
Scheduled Task/JobValid AccountsAccount ManipulationModify Authentication Process
Privilege Escalation
Scheduled Task/JobValid AccountsAccount ManipulationDomain or Tenant Policy Modification
Stealth
Obfuscated Files or InformationMasqueradingValid AccountsSystem Binary Proxy Execution
Defense Impairment
Domain or Tenant Policy ModificationModify Authentication ProcessModify Cloud Compute Infrastructure
Credential Access
OS Credential DumpingBrute ForceUnsecured CredentialsCredentials from Password StoresModify Authentication Process
Discovery
Process DiscoverySystem Information DiscoveryAccount DiscoveryDomain Trust DiscoverySoftware DiscoveryCloud Service DiscoveryCloud Infrastructure DiscoverySystem Location Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Transfer Data to Cloud AccountExfiltration Over Web Service
Impact
Data DestructionData Encrypted for ImpactInhibit System RecoveryFinancial Theft
Software
AADInternals · Cobalt Strike · Embargo · Impacket · Net · Nltest · Rclone · Tasklist