Storm-0501 hackers shift to ransomware attacks in the cloud

Microsoft warns that Storm-0501 has evolved from deploying on-premises ransomware to cloud-native attacks that compromise Entra ID and Azure environments, use stolen Directory Synchronization Accounts and malicious federated domains to escalate to Owner roles, exfiltrate and destroy Azure Storage and backups, create Key Vaults and customer-managed keys to render cloud data inaccessible, and extort victims via compromised Microsoft Teams accounts.