Financially motivated

Storm-0501

Storm-0501 is a financially motivated ransomware group tracked by Microsoft that expanded into hybrid cloud attacks. It pivots from on premises Active Directory into Microsoft Entra ID and builds a backdoor federated domain. It then exfiltrates data and deploys Embargo ransomware or keeps persistent cloud access.

Cloud tradecraft

Compromises Entra Connect Sync accounts to reach the cloud tenant
Resets cloud passwords of synced hybrid accounts with AADInternals
Password sprays to find valid cloud and admin accounts
Adds a malicious federated domain to forge SAML tokens
Uses forged tokens to impersonate any user and bypass MFA

MITRE ATT&CK techniques

T1078.004 T1110.003 T1484.002 T1606.002 T1556.007

References

Storm-0501: Ransomware attacks expanding to hybrid cloud environments
Storm-0501's evolving techniques lead to cloud-based ransomware

Prevent these techniques in your AWS accounts

Pathbreak validates which of these techniques resolve against your real AWS authorization and gives you the change that breaks each path, so an attacker cannot chain it.

Request a free scan Browse the attack map