Storm-0501
- ID
- G1053
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.[1][2][3][4]
Techniques used (42)
- T1003 OS Credential Dumping
- T1003.006 DCSync
- T1021.006 Windows Remote Management
- T1021.007 Cloud Services
- T1027.002 Software Packing
- T1036.004 Masquerade Task or Service
- T1053.005 Scheduled Task
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.009 Cloud API
- T1078.004 Cloud Accounts
- T1082 System Information Discovery
- T1087.002 Domain Account
- T1087.004 Cloud Account
- T1098.001 Additional Cloud Credentials
- T1098.003 Additional Cloud Roles
- T1110 Brute Force
- T1190 Exploit Public-Facing Application
- T1218.010 Regsvr32
- T1218.011 Rundll32
- T1219.002 Remote Desktop Software
- T1482 Domain Trust Discovery
- T1484.001 Group Policy Modification
- T1484.002 Trust Modification
- T1485 Data Destruction
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1518.001 Security Software Discovery
- T1526 Cloud Service Discovery
- T1530 Data from Cloud Storage
- T1537 Transfer Data to Cloud Account
- T1552.004 Private Keys
- T1555.005 Password Managers
- T1555.006 Cloud Secrets Management Stores
- T1556.009 Conditional Access Policies
- T1567.002 Exfiltration to Cloud Storage
- T1578.003 Delete Cloud Instance
- T1580 Cloud Infrastructure Discovery
- T1587.003 Digital Certificates
- T1588.006 Vulnerabilities
- T1614.001 System Language Discovery
- T1657 Financial Theft
Software used (8)
- S0039 Net
- S0057 Tasklist
- S0154 Cobalt Strike
- S0357 Impacket
- S0359 Nltest
- S0677 AADInternals
- S1040 Rclone
- S1247 Embargo