Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.1234
- Avertium Storm-0501 Sabbath Ransomware Arcane January 2022
- Microsoft Storm-501 Sabbath Ransomware Embargo September 2024
- Microsoft Storm-0501 Embargo Ransomware August 2025
- Google Mandiant Storm-0501 Sabbath Ransomware November 2021
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Storm-0501 | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1537 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1490 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1484.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1530 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1485 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1526 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.009 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.007 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.010 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1555.005 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1484.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1580 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1482 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1578.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1614.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.006 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556.009 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003 | OS Credential Dumping | — |
| T1003.006 | DCSync | — |
| T1021.006 | Windows Remote Management | — |
| T1021.007 | Cloud Services | — |
| T1027.002 | Software Packing | — |
| T1036.004 | Masquerade Task or Service | — |
| T1053.005 | Scheduled Task | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.009 | Cloud API | — |
| T1078.004 | Cloud Accounts | — |
| T1082 | System Information Discovery | — |
| T1087.002 | Domain Account | — |
| T1087.004 | Cloud Account | — |
| T1098.001 | Additional Cloud Credentials | — |
| T1098.003 | Additional Cloud Roles | — |
| T1110 | Brute Force | — |
| T1190 | Exploit Public-Facing Application | — |
| T1218.010 | Regsvr32 | — |
| T1218.011 | Rundll32 | — |
| T1219.002 | Remote Desktop Software | — |
| T1482 | Domain Trust Discovery | — |
| T1484.001 | Group Policy Modification | — |
| T1484.002 | Trust Modification | — |
| T1485 | Data Destruction | — |
| T1486 | Data Encrypted for Impact | — |
| T1490 | Inhibit System Recovery | — |
| T1518.001 | Security Software Discovery | — |
| T1526 | Cloud Service Discovery | — |
| T1530 | Data from Cloud Storage | — |
| T1537 | Transfer Data to Cloud Account | — |
| T1552.004 | Private Keys | — |
| T1555.005 | Password Managers | — |
| T1555.006 | Cloud Secrets Management Stores | — |
| T1556.009 | Conditional Access Policies | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1578.003 | Delete Cloud Instance | — |
| T1580 | Cloud Infrastructure Discovery | — |
| T1587.003 | Digital Certificates | — |
| T1588.006 | Vulnerabilities | — |
| T1614.001 | System Language Discovery | — |
| T1657 | Financial Theft | — |
Aliases
Storm-0501
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.