G1053 · ATT&CK 20.0 group
Storm-0501
Aliases: Storm-0501
[Storm-0501](https://attack.mitre.org/groups/G1053) is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. [Storm-0501](https://attack.mitre.org/groups/G1053) has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, [BlackCat](https://attack.mitre.org/software/S1068), Hunters International, [LockBit 3.0](https://attack.mitre.org/software/S1202), and [Embargo](https://attack.mitre.org/software/S1247) ransomware.(Citation: Avertium Storm-0501 Sabbath Ransomware Arcane January 2022)(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)(Citation: Google Mandiant Storm-0501 Sabbath Ransomware November 2021)
Aliases: Storm-0501
ATT&CK techniques
T1003T1003.006T1021.006T1021.007T1027.002T1036.004T1053.005T1057T1059.001T1059.009T1078.004T1082T1087.002T1087.004T1098.001T1098.003T1110T1190T1218.010T1218.011T1219.002T1482T1484.001T1484.002T1485T1486T1490T1518.001T1526T1530T1537T1552.004T1555.005T1555.006T1556.009T1567.002T1578.003T1580T1587.003T1588.006T1614.001T1657
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Net tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Tasklist tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Cobalt Strike tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Impacket tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Nltest tool reference — Explicit actor uses software relationship in pinned ATT&CK
- AADInternals tool reference — Explicit actor uses software relationship in pinned ATT&CK
- Rclone tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1003 OS Credential Dumping simulation — Exact active technique ID
- T1003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1003.006 DCSync simulation — Exact active technique ID
- T1003.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.006 Windows Remote Management simulation — Exact active technique ID
- T1021.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1021.007 Cloud Services simulation — Exact active technique ID
- T1021.007 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1027.002 Software Packing simulation — Exact active technique ID
- T1027.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1036.004 Masquerade Task or Service simulation — Exact active technique ID
- T1036.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1053.005 Scheduled Task simulation — Exact active technique ID
- T1053.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1057 Process Discovery simulation — Exact active technique ID
- T1057 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.001 PowerShell simulation — Exact active technique ID
- T1059.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059.009 Cloud API simulation — Exact active technique ID
- T1059.009 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078.004 Cloud Accounts simulation — Exact active technique ID
- T1078.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1082 System Information Discovery simulation — Exact active technique ID
- T1082 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.002 Domain Account simulation — Exact active technique ID
- T1087.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1087.004 Cloud Account simulation — Exact active technique ID
- T1087.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098.001 Additional Cloud Credentials simulation — Exact active technique ID
- T1098.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1098.003 Additional Cloud Roles simulation — Exact active technique ID
- T1098.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110 Brute Force simulation — Exact active technique ID
- T1110 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1190 Exploit Public-Facing Application simulation — Exact active technique ID
- T1190 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.010 Regsvr32 simulation — Exact active technique ID
- T1218.010 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1218.011 Rundll32 simulation — Exact active technique ID
- T1218.011 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1219.002 Remote Desktop Software simulation — Exact active technique ID
- T1219.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1482 Domain Trust Discovery simulation — Exact active technique ID
- T1482 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1484.001 Group Policy Modification simulation — Exact active technique ID
- T1484.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1484.002 Trust Modification simulation — Exact active technique ID
- T1484.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1485 Data Destruction simulation — Exact active technique ID
- T1485 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1486 Data Encrypted for Impact simulation — Exact active technique ID
- T1486 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1490 Inhibit System Recovery simulation — Exact active technique ID
- T1490 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1518.001 Security Software Discovery simulation — Exact active technique ID
- T1518.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1526 Cloud Service Discovery simulation — Exact active technique ID
- T1526 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1530 Data from Cloud Storage simulation — Exact active technique ID
- T1530 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1537 Transfer Data to Cloud Account simulation — Exact active technique ID
- T1537 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1552.004 Private Keys simulation — Exact active technique ID
- T1552.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.005 Password Managers simulation — Exact active technique ID
- T1555.005 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1555.006 Cloud Secrets Management Stores simulation — Exact active technique ID
- T1555.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1556.009 Conditional Access Policies simulation — Exact active technique ID
- T1556.009 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1567.002 Exfiltration to Cloud Storage simulation — Exact active technique ID
- T1567.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1578.003 Delete Cloud Instance simulation — Exact active technique ID
- T1578.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1580 Cloud Infrastructure Discovery simulation — Exact active technique ID
- T1580 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1587.003 Digital Certificates simulation — Exact active technique ID
- T1587.003 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.006 Vulnerabilities simulation — Exact active technique ID
- T1588.006 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1614.001 System Language Discovery simulation — Exact active technique ID
- T1614.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1657 Financial Theft simulation — Exact active technique ID
- T1657 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Module 1 — Foundations: What CTI Is
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 9 — Identity defense and ITDR
Blue Team & Defensive Security · explicit-nameCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-name
Cyber Threat Intelligence (CTI) · explicit-idModule 3 — Core Frameworks Models
Cyber Threat Intelligence (CTI) · explicit-idModule 8 — Operationalizing CTI (CTI → Detection)
Cyber Threat Intelligence (CTI) · explicit-idModule 4 — Detection engineering and detection as code
Blue Team & Defensive Security · explicit-idExploitability validation and laboratory exploit engineering
Vulnerability Research & Exploit Development · explicit-idModule 9 — Identity defense and ITDR
Blue Team & Defensive Security · explicit-nameCompute, managed services, serverless, SaaS, and workload hardening
Cloud Security · explicit-nameModule 7 — Privilege, lateral movement, and controlled impact
Red Team & Offensive Security · explicit-nameModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · explicit-nameControlled dynamic behavior and differential observation
Malware Analysis & Reverse Engineering · explicit-nameWindows endpoint and identity forensics
Digital Forensics & Incident Response (DFIR) · explicit-nameModule 5 — Threat hunting
Blue Team & Defensive Security · explicit-name