Storm-0501 is a financially motivated cybercriminal group that emerged in 2021, initially deploying Sabbath ransomware against US school districts. The group rapidly evolved to adopt a Ransomware-as-a-Service (RaaS) model, integrating various ransomware strains such as Hive, BlackCat, Hunters International, LockBit, INC, Lynx, and Embargo into its operations. A significant shift in their methodology occurred in 2024 and 2025, moving towards cloud-native ransomware tactics where they abuse legitimate cloud features and capabilities for data exfiltration and destruction, rather than relying solely on traditional malware deployment. This group is distinguished by its adaptive strategy, including a quick pivot following the takedown of the Hive RaaS network, and its proficiency in exploiting hybrid cloud environments, moving seamlessly between on-premises and cloud infrastructures. Storm-0501 is also known by the alias Hunters International.

Actores similares

stormousransomware · 177crimson-sandstormactor · 1Storm-1811actor · 1Dust Stormapt · 1storm-cloudactor · 1unc1549-crimson-sandstormactor · 1smoke-sandstorm-cuboid-saactor · 1Storm-0324apt · 0Storm-2372apt · 0Storm-2949apt · 0

Paises afectados