Storm-0501Threat actor
Storm-0501 is a financially motivated cybercriminal group that has been active since 2021, initially targeting US school districts with the Sabbath ransomware and later transitioning to a RaaS model deploying various ransomware strains, including Embargo.From MISP Galaxy
Last reported 4 months ago, by Datadog Security Labs1 report
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Holding blobs for ransom: Four methods for Azure Storage ransomware“Microsoft released detailed reporting on STORM-0501 abusing encryption scopes to extract a ransomware payment from victims.”
Indicators in its reports
named in the reports above- hxxps://management.azure[.]com/subscriptions/$in 1 report
- hxxps://stratusrtqwgejtyj.vault.azure[.]net/keys/ransom-encryption-key/b4aaac30826542a9bea74346d51bd576in 1 report
- hxxps://stratusrtqwgejtyj.vault.azure[.]net/keys/ransom-encryption-keyin 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.