Storm-0501
IntrusionSet · ATTACK:enterprise:G1053
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1053",
"title": "Storm-0501",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1053",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--7b404cd0-3ae9-41d4-90c0-023793d35d97",
"external_id": "G1053",
"domain": "enterprise",
"created": "2025-10-19T19:08:22.474Z",
"modified": "2026-07-31T18:48:03.011Z",
"version": "1.0",
"aliases": [
"Storm-0501"
],
"tactics": [
],
"source_references": [
{
"source_name": "Avertium Storm-0501 Sabbath Ransomware Arcane January 2022",
"url": "https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang"
},
{
"source_name": "Microsoft Storm-501 Sabbath Ransomware Embargo September 2024",
"url": "https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"
},
{
"source_name": "Microsoft Storm-0501 Embargo Ransomware August 2025",
"url": "https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"
},
{
"source_name": "Google Mandiant Storm-0501 Sabbath Ransomware November 2021",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/"
}
]
}Explicit source assertions (50)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03fb981b-6ee6-4490-ab5d-d671691abdf6
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--07155ad6-9833-4acd-b3d4-501bcb949d73
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1219.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ea2fee2-66aa-4c6a-9617-94cbdbdf4d4b
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1537
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16e7e622-1e34-48fe-954c-e1a4b103e204
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1490
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a549ce9-124b-4a88-997f-c52b3a39a6bc
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1484.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--26682a7a-d866-438c-a4c1-25b66e5b5356
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0154
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2b25526e-abb9-4c6b-aa68-cc645734cdfb
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1530
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35589283-3028-444b-94d1-9b64ae6d8487
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37224c2a-26a2-40cd-bcf1-a3f309c0fc63
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--38938866-d940-4223-b811-e3b8420f6408
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47dddbb1-92c0-4a3f-8234-8418966be1ea
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1087.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4edc6f43-cdcd-406c-b384-ac789cd04d75
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1003.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5213c71d-65b1-43cb-8c6a-8b629448d1c9
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1526
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52288e4e-f430-472a-b5aa-f875f1007d73
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--529460a7-ddd1-406c-bbef-ae2ec4eb4c02
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025 · Google Mandiant Storm-0501 Sabbath Ransomware November 2021ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1059.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5d2683e0-74e3-4858-b702-fdb4d7cf8a55
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1021.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--604eeaa1-b458-43a6-9618-7c55b8bc7a62
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S1247
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62cee7c8-f34d-4167-b861-1734d72d888d
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1021.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--64642489-4a11-48e3-a31e-b3cee75bd7be
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--65971cda-62b8-4685-8070-3d61ded0850d
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b2d240a-66f6-484c-a6f6-04661860ae0e
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--71219800-4802-4029-bf24-fc09503ad05d
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--72afd916-54df-4524-acbd-1058b5dbe650
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73f90bbd-538b-49d8-a84c-86b0353a5557
Avertium Storm-0501 Sabbath Ransomware Arcane January 2022 · Microsoft Storm-0501 Embargo Ransomware August 2025 · Google Mandiant Storm-0501 Sabbath Ransomware November 2021ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7b82c1d0-b675-47bd-bb8c-3e0fb96c304a
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1078.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7fd8e4e2-baaf-4a2a-9c4e-31f5a759978f
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1218.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81075bd9-4986-4fb7-9530-287449e1b633
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1555.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--950263e2-095b-4e12-8c46-cfd6935f9ac7
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1555.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a228727a-69ef-4cf6-aa2a-808e0116249c
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1484.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ada346d2-69ce-489a-9a95-14ddc998a960
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0359
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b14bb111-fcab-45fc-87cb-6b4e49270a1a
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1580
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2e1d4a6-9282-48b8-a049-550255a13106
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8ae763a-289b-4c4c-abd1-fb89eeab30ea
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1578.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8d3372c-ac09-4247-8714-46947f669908
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--baf93cec-ad47-4380-bda7-9569e088b5e9
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf20f37d-ce08-44f1-bc68-f444aabde3c7
Google Mandiant Storm-0501 Sabbath Ransomware November 2021ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1614.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4902c5f-62a8-4eb7-b86a-fb701ce8fc5f
Avertium Storm-0501 Sabbath Ransomware Arcane January 2022 · Google Mandiant Storm-0501 Sabbath Ransomware November 2021ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1552.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dabf635b-40fd-45e1-b7b8-ed6de9d1bf22
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1036.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--de222d7d-70ab-43be-a957-b2918a11614e
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1098.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e336149c-2d17-4be0-96e2-a99e6e278102
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e45efac0-c894-4676-a503-d8c1aa0cb117
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1218.011
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5e87038-b2f0-4bfd-ab5a-4510c78e18c9
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1587.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e612293a-23f1-457e-b92c-43c84f57389a
Google Mandiant Storm-0501 Sabbath Ransomware November 2021ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1588.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec384765-a84b-40f3-abf9-5bec1f7e5f10
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eea7a647-322f-4d4a-a6b4-28b3b8ca8f32
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1556.009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f0894c45-664e-4148-a8a0-6ea0ed4c253a
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8f09842-7360-461d-98b6-b1e9e6a77332
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1110
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa9a28d1-3623-478b-a9db-8aa587ec44d1
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1098.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fbae351b-0a1a-4761-9e5f-31aa39eb98d1
Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0677
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ff916215-e7dc-410a-919c-83a00eb95dc1
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024