Storm-0501 Deploys Cloud-Based Ransomware (Campaign)
ID: 10d5a4eb-90fc-5343-8468-b42bdbd0f2bc
STIX ID: report--10d5a4eb-90fc-5343-8468-b42bdbd0f2bc
Feed Name: Wiz Cloud Threat Landscape
Date Published: 2025-08-28
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
Storm-0501 escalated from on-premises domain-admin access to cloud-based ransomware operations by compromising Entra Connect and a synced Global Administrator, registering MFA to satisfy Conditional Access, establishing cloud persistence via a malicious federated domain, elevating to Global Admin to mass-assign subscription ownership, exposing storage and exfiltrating data with AzCopy, and deleting or encrypting cloud resources (including backups) before extorting victims via Microsoft Teams.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.