Analytics Story: Storm-0501 Ransomware

Date: 2026-01-20 ID: 97b6cb8f-2b29-48e2-9d06-f9521302f955 Author: Michael Haag, Splunk Product: Splunk Enterprise Security

Description

Detects tactics, techniques, and procedures (TTPs) associated with Storm-0501, a financially motivated ransomware-as-a-service (RaaS) affiliate that has evolved from targeting on-premises environments to sophisticated hybrid cloud attacks. Storm-0501 has deployed multiple ransomware families including Hive, BlackCat/ALPHV, Hunters International, LockBit, and most recently Embargo ransomware. The group is known for targeting government, manufacturing, transportation, law enforcement, and healthcare sectors, primarily in the United States. This analytic story provides comprehensive detection coverage for their complete attack chain, from initial credential abuse through Azure AD/Entra ID compromise and cloud-native ransomware deployment.

Why it matters

Storm-0501, active since 2021 (originally operating as Sabbath/54bb47h), represents a significant evolution in hybrid cloud ransomware operations. Their attack methodology begins with exploitation of weak credentials and over-privileged accounts for initial access, followed by extensive Active Directory reconnaissance using tools like ADRecon. The group leverages Impacket tools (wmiexec, smbexec, atexec), PsExec, and legitimate RMM software (AnyDesk, Level.io, NinjaOne) for lateral movement, while Cobalt Strike provides command and control capabilities. The critical differentiator in Storm-0501 operations is their hybrid cloud pivot technique. After compromising on-premises infrastructure and extracting NTDS.dit credentials, the group targets Azure AD Connect sync accounts (MSOL_, Sync_) to gain access to cloud environments. Once in Azure AD/Entra ID, they establish persistence through federated domain manipulation, create backdoor service principals, and escalate privileges to Global Administrator. Recent intelligence indicates Storm-0501 has evolved toward cloud-native ransomware tactics, leveraging legitimate cloud APIs to exfiltrate data using Rclone, destroy Azure backups, and manipulate M365 retention policies without deploying traditional ransomware binaries. This evolution makes traditional endpoint-based detection insufficient and requires robust cloud audit log monitoring. Detections in this story cover credential dumping, lateral movement tools, defense evasion, Azure AD persistence mechanisms, backup deletion, and data exfiltration patterns characteristic of Storm-0501 campaigns.

Detections

Name ▲▼	Technique ▲▼	Type ▲▼
Azure AD New Federated Domain Added	Trust Modification	TTP
Azure AD Privileged Role Assigned	Additional Cloud Roles	TTP
Common Ransomware Notes	Data Destruction	Hunting
Detect PsExec With accepteula Flag	SMB/Windows Admin Shares	TTP
Detect RClone Command-Line Usage	Automated Exfiltration	TTP
Detect Remote Access Software Usage Process	Remote Access Tools	Anomaly
Disable Windows Behavior Monitoring	Disable or Modify Tools	TTP
Impacket Lateral Movement Commandline Parameters	SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service	TTP
Impacket Lateral Movement WMIExec Commandline Parameters	SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service	TTP
NLTest Domain Trust Discovery	Domain Trust Discovery	TTP
SecretDumps Offline NTDS Dumping Tool	NTDS	TTP
Suspicious wevtutil Usage	Clear Windows Event Logs	TTP
WBAdmin Delete System Backups	Inhibit System Recovery	TTP
Windows Suspicious C2 Named Pipe	Inter-Process Communication, SMB/Windows Admin Shares, Process Injection	TTP

Data Sources

Name ▲▼	Platform ▲▼	Sourcetype ▲▼	Source ▲▼
Azure Active Directory Add member to role	Azure	`azure:monitor:aad`	`Azure AD`
Azure Active Directory Set domain authentication	Azure	`azure:monitor:aad`	`Azure AD`
Cisco Network Visibility Module Flow Data	Network	`cisco:nvm:flowdata`	`not_applicable`
CrowdStrike ProcessRollup2	Other	`crowdstrike:events:sensor`	`crowdstrike`
Sysmon EventID 1	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 11	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 13	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 17	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Sysmon EventID 18	Windows	`XmlWinEventLog`	`XmlWinEventLog:Microsoft-Windows-Sysmon/Operational`
Windows Event Log Security 4688	Windows	`XmlWinEventLog`	`XmlWinEventLog:Security`

References

Source: GitHub | Version: 1