Overview
Storm-0501 is escalating hybrid cloud attacks by exploiting Microsoft Entra ID to steal data and delete Azure resources. Unlike traditional ransomware, it uses cloud-native methods for rapid exfiltration and extortion, affecting sectors from healthcare to education.
Technical Details
- Initial Access: Gained via stolen/compromised credentials from access brokers (Storm-0249, Storm-0900) or exploitation of unpatched internet-facing servers (Zoho ManageEngine, Citrix NetScaler, Adobe ColdFusion).
- Privilege Escalation: Leveraged compromised accounts to escalate to domain admin, then abused Directory Synchronization Accounts to gain Global Admin in Entra ID.
- Lateral Movement: Used Evil-WinRM for movement across systems; executed DCSync attacks to extract credentials from Active Directory.
- Persistence: Registered attacker-controlled Entra ID tenant as a trusted federated domain, creating a stealthy cloud backdoor.
- Credential Access: Extracted sensitive ……
