Threat intelligence / Group

Storm-0501

[Storm-0501](https://attack.mitre.org/groups/G1053) is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. [Storm-0501](https://attack.mitre.org/groups/G1053) has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, [BlackCat](https://attack.mitre.org/software/S1068), Hunters International, [LockBit 3.0](https://attack.mitre.org/software/S1202), and [Embargo](https://attack.mitre.org/software/S1247) ransomware.(Citation: Avertium Storm-0501 Sabbath Ransomware Arcane January 2022)(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)(Citation: Google Mandiant Storm-0501 Sabbath Ransomware November 2021)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Storm-0501](https://attack.mitre.org/groups/G1053) is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. [Storm-0501](https://attack.mitre.org/groups/G1053) has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, [BlackCat](https://attack.mitre.org/software/S1068), Hunters International, [LockBit 3.0](https://attack.mitre.org/software/S1202), and [Embargo](https://attack.mitre.org/software/S1247) ransomware.(Citation: Avertium Storm-0501 Sabbath Ransomware Arcane January 2022)(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)(Citation: Google Mandiant Storm-0501 Sabbath Ransomware November 2021)

50 recorded

Relationships

uses

to AADInternals

Tool

uses

to Additional Cloud Credentials

Technique

uses

to Additional Cloud Roles

Technique

uses

Technique

uses

to Cloud Account

Technique

uses

to Cloud Accounts

Technique

uses

Technique

uses

to Cloud Infrastructure Discovery

Technique

uses

to Cloud Secrets Management Stores

Technique

uses

to Cloud Service Discovery

Technique

uses

to Cloud Services

Technique

uses

to Cobalt Strike

Malware

uses

to Conditional Access Policies

Technique

uses

to Data Destruction

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Data from Cloud Storage

Technique

uses

Technique

uses

to Delete Cloud Instance

Technique

uses

to Digital Certificates

Technique

uses

to Domain Account

Technique

uses

to Domain Trust Discovery

Technique

uses

Malware

uses

to Exfiltration to Cloud Storage

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to Financial Theft

Technique

uses

to Group Policy Modification

Technique

uses

Tool

uses

to Inhibit System Recovery

Technique

uses

to Masquerade Task or Service

Technique

uses

to Net

Tool

uses

Tool

uses

to OS Credential Dumping

Technique

uses

to Password Managers

Technique

uses

Technique

uses

to Private Keys

Technique

uses

to Process Discovery

Technique

uses

Tool

uses

Technique

uses

to Remote Desktop Software

Technique

uses

Technique

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to Software Packing

Technique

uses

to System Information Discovery

Technique

uses

to System Language Discovery

Technique

uses

Tool

uses

to Transfer Data to Cloud Account

Technique

uses

to Trust Modification

Technique

uses

to Vulnerabilities

Technique

uses

to Windows Remote Management

Technique

5 external

References

mitre-attack

G1053

Avertium Storm-0501 Sabbath Ransomware Arcane January 2022

https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang

Microsoft Storm-501 Sabbath Ransomware Embargo September 2024

https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/

Microsoft Storm-0501 Embargo Ransomware August 2025

https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/

Google Mandiant Storm-0501 Sabbath Ransomware November 2021

https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/