- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G1053 · 42 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0158 · storm-0501
What it is
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.
Tools
The tools and malware families the sources tie to it.
- AADInternals
- Backdoor.Oldrea
- CloudDuke
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Embargo
- Impacket
- Net
- Nltest
- Rclone
- Tasklist
- UNITEDRAKE
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- Malpedia malpedia.caad.fkie.fraunhofer.de