Storm0501 shifts to hybrid ransomware targeting on-prem and cloud

A financially motivated threat group known as Storm0501 has refined its tactics to mount hybrid ransomware campaigns that exploit gaps between on premises and cloud environments, hijack privileged accounts, delete backups and encrypt or exfiltrate cloud data, cybersecurity researchers warned. The group’s new approach leverages native cloud capabilities and synchronized identity services to achieve rapid, large scale disruption and extortion, leaving victims with limited recovery options unless they pay.

Storm0501 has been active since at least 2021 and has previously used a variety of ransomware strains. In recent incidents the group has moved beyond traditional endpoint encryption to a cloud focused playbook. Investigators say attackers first seek visibility gaps in complex enterprise estates, then use on premises footholds to pivot into Azure tenants, escalate to global administrator privileges that lack multifactor authentication, create persistent backdoors and use built in cloud features to steal, encrypt or delete large volumes of data and backups.

"They are not just encrypting the data; they are deleting backups so that you cannot say, ‘Oh, that is fine, we will recover...