Threat Actor Profile
Description
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.(Citation: Avertium Storm-0501 Sabbath Ransomware Arcane January 2022)(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)(Citation: Google Mandiant Storm-0501 Sabbath Ransomware November 2021)
Confidence Score
Known Aliases
Tags
First Seen
Unknown
Last Updated
Unknown
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (42)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': ['Storm-0501'],
'created': '2025-10-19T19:08:22.474Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': '[Storm-0501](https://attack.mitre.org/groups/G1053) is a '
'financially motivated cyber criminal group that uses '
'commodity and open-source tools to conduct ransomware '
'operations. '
'[Storm-0501](https://attack.mitre.org/groups/G1053) has been '
'active since 2021 and has previously been affiliated with '
'Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) '
'variants such as Hive, '
'[BlackCat](https://attack.mitre.org/software/S1068), Hunters '
'International, [LockBit '
'3.0](https://attack.mitre.org/software/S1202), and '
'[Embargo](https://attack.mitre.org/software/S1247) '
'ransomware.(Citation: Avertium Storm-0501 Sabbath Ransomware '
'Arcane January 2022)(Citation: Microsoft Storm-501 Sabbath '
'Ransomware Embargo September 2024)(Citation: Microsoft '
'Storm-0501 Embargo Ransomware August 2025)(Citation: Google '
'Mandiant Storm-0501 Sabbath Ransomware November 2021)',
'external_references': [{'external_id': 'G1053',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G1053'},
{'description': 'Avertium. (2022, January 11). An '
'In-Depth Look at Ransomware Gang, '
'Sabbath. Retrieved October 19, 2025.',
'source_name': 'Avertium Storm-0501 Sabbath '
'Ransomware Arcane January 2022',
'url': 'https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang'},
{'description': 'Microsoft Threat Intelligence. '
'(2024, September 26). Storm-0501: '
'Ransomware attacks expanding to '
'hybrid cloud environments. Retrieved '
'October 19, 2025.',
'source_name': 'Microsoft Storm-501 Sabbath '
'Ransomware Embargo September 2024',
'url': 'https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/'},
{'description': 'Microsoft Threat Intelligence. '
'(2025, August 27). Storm-0501’s '
'evolving techniques lead to '
'cloud-based ransomware. Retrieved '
'October 19, 2025.',
'source_name': 'Microsoft Storm-0501 Embargo '
'Ransomware August 2025',
'url': 'https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/'},
{'description': 'Tyler McLellan, Brandan Schondorfer. '
'(2021, November 29). Kitten.gif: '
'Meet the Sabbath Ransomware '
'Affiliate Program, Again. Retrieved '
'October 19, 2025.',
'source_name': 'Google Mandiant Storm-0501 Sabbath '
'Ransomware November 2021',
'url': 'https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/'}],
'id': 'intrusion-set--7b404cd0-3ae9-41d4-90c0-023793d35d97',
'modified': '2025-10-24T02:33:31.401Z',
'name': 'Storm-0501',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'intrusion-set',
'x_mitre_attack_spec_version': '3.3.0',
'x_mitre_deprecated': False,
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_version': '1.0'}