Storm-0501 Targeting Hybrid Environments with Ransomware (Campaign)

Storm-0501 is conducting multi-stage, financially motivated ransomware campaigns targeting hybrid cloud environments across U.S. sectors by exploiting public-facing vulnerabilities (e.g., Zoho ManageEngine CVE-2022-47966, Citrix NetScaler CVE-2023-4966), abusing weak credentials and Entra Connect Sync to pivot to cloud tenants, and using tools like Cobalt Strike, AnyDesk, OSQuery, Impacket SecretsDump, and Rclone for reconnaissance, credential theft, lateral movement, persistence, and data exfiltration before deploying ransomware (Embargo).