Ransomware gang using stolen Microsoft Entra ID creds to bust into the cloud

Microsoft warns that Storm-0501, an emerging financially motivated group active since 2021, is pivoting from on-prem to hybrid cloud environments by stealing Entra Connect credentials and compromising unprotected cloud admin accounts to implant backdoors and enable data theft and ransomware (recently observed using the Embargo payload); Microsoft provides detection guidance and IOCs.