The intruder is in the house: Storm-0501 attacked Azure, stole data, demanded payment via Teams

Microsoft tracked a financially motivated group named Storm-0501 that shifted from traditional endpoint ransomware to cloud-native attacks: they compromised Entra Connect servers, used DCSync and credential theft to escalate to Entra global admin, registered a malicious federated tenant and obtained broad Azure privileges, then exfiltrated and deleted data in the victim's Azure environment and extorted the organization via a compromised Teams account; Microsoft provides mitigation guidance including enforcing MFA, least privilege, and protecting sync servers.