From 50b2ad7c23fd6655a691fe5a995cc4999b6b4036 Mon Sep 17 00:00:00 2001 From: Mathieu4141 Date: Wed, 2 Oct 2024 02:04:56 -0700 Subject: [PATCH] [threat-actors] Add Storm-0501 --- clusters/threat-actor.json | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 90e264c..392776f 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -16885,6 +16885,16 @@ }, "uuid": "7b14f285-86e9-47da-be1a-16ce566c428b", "value": "Handala" + }, + { + "description": "Storm-0501 is a financially motivated cybercriminal group that has been active since 2021, initially targeting US school districts with the Sabbath ransomware and later transitioning to a RaaS model deploying various ransomware strains, including Embargo. The group exploits weak credentials and over-privileged accounts to achieve lateral movement from on-premises environments to cloud infrastructures, establishing persistent backdoor access and deploying ransomware. They have utilized techniques such as credential theft, exploiting vulnerabilities in Zoho ManageEngine and Citrix NetScaler, and employing tools like Cobalt Strike and Rclone for lateral movement and data exfiltration. Storm-0501 has specifically targeted sectors such as government, manufacturing, transportation, and law enforcement in the United States.", + "meta": { + "refs": [ + "https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/" + ] + }, + "uuid": "f6a60403-4bcc-4fc6-ac07-abb913c1f080", + "value": "Storm-0501" } ], "version": 315