Storm-0501 attacking hybrid environments with ransomware (Campaign)

Storm-0501 is a ransomware-focused threat actor expanding operations into hybrid cloud environments; the group gains initial access through phishing and public-facing application exploits, steals credentials (e.g., Mimikatz), uses Cobalt Strike for C2, establishes persistence (scheduled tasks, new accounts), exfiltrates sensitive data, and deploys custom encryption to lock both on-premises and cloud-hosted assets, including VMs and cloud storage while exploiting IAM misconfigurations.