Storm-0501

Techniques (MITRE ATT&CK)42

SourceMITRE ATT&CK

Vexday analysis

Storm-0501 é um grupo cibercriminoso com motivação financeira ativo desde 2021, especializado em operações de ransomware com uso de ferramentas de código aberto e commodities. O grupo possui histórico de afiliação com múltiplas plataformas de Ransomware-as-a-Service (RaaS), incluindo Sabbath, Hive, BlackCat, Hunters International, LockBit 3.0 e Embargo. Catalogado no MITRE ATT&CK sob o identificador G1053, tem 42 técnicas documentadas e 7 CVEs atribuídas a seu repertório de exploração.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity79

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 42

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Digital Certificates Vulnerabilities

Initial access

Exploit Public-Facing Application

Execution

Scheduled Task PowerShell Cloud API

Persistence

Additional Cloud Credentials Additional Cloud Roles

Credential access

OS Credential Dumping DCSync Brute Force Private Keys Password Managers Cloud Secrets Management Stores

Discovery

Process Discovery System Information Discovery Domain Account Cloud Account Domain Trust Discovery Security Software Discovery Cloud Service Discovery Cloud Infrastructure Discovery System Language Discovery

Lateral movement

Windows Remote Management Cloud Services

Collection

Data from Cloud Storage

Command and control

Remote Desktop Software

Exfiltration

Transfer Data to Cloud Account Exfiltration to Cloud Storage

Impact

Data Destruction Data Encrypted for Impact Inhibit System Recovery Financial Theft

defense-impairment

Group Policy Modification Trust Modification Conditional Access Policies Delete Cloud Instance

stealth

Software Packing Masquerade Task or Service Cloud Accounts Regsvr32 Rundll32

Exploited vulnerabilities 7

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2023-4966CRITICALEPSS 100%KEV CVE-2023-29300CRITICALEPSS 100%KEV CVE-2014-7169CRITICALEPSS 100%KEV CVE-2022-47966CRITICALEPSS 100%KEV CVE-2023-38203CRITICALEPSS 97%KEV CVE-2016-6662EPSS 68%CVE-2019-3610MEDIUMEPSS 0%

Known infrastructure 1255

Real indicators (C2, domains, URLs and hashes) associated with the malware this group uses. Source: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port68.64.182.169:110Cobalt Strikethreatfox

ip:port68.64.182.169:465Cobalt Strikethreatfox

ip:port101.42.255.92:8443Cobalt Strikethreatfox

ip:port68.64.182.169:995Cobalt Strikethreatfox

ip:port68.64.182.169:7000Cobalt Strikethreatfox

ip:port68.64.182.169:8000Cobalt Strikethreatfox

ip:port68.64.182.169:7010Cobalt Strikethreatfox

ip:port8.163.59.20:22Cobalt Strikethreatfox

ip:port178.128.80.204:22Cobalt Strikethreatfox

ip:port68.64.182.169:4190Cobalt Strikethreatfox

ip:port68.64.182.169:993Cobalt Strikethreatfox

ip:port91.92.42.118:13019Cobalt Strikethreatfox

ip:port118.31.18.77:2301Cobalt Strikethreatfox

ip:port119.29.122.42:8080Cobalt Strikethreatfox

ip:port68.64.182.169:587Cobalt Strikethreatfox

ip:port119.29.122.42:80Cobalt Strikethreatfox

ip:port119.29.122.42:443Cobalt Strikethreatfox

ip:port68.64.182.169:3306Cobalt Strikethreatfox

ip:port68.64.182.169:8010Cobalt Strikethreatfox

ip:port68.64.182.169:5727Cobalt Strikethreatfox

ip:port68.64.182.169:111Cobalt Strikethreatfox

ip:port68.64.182.169:443Cobalt Strikethreatfox

ip:port68.64.182.169:8080Cobalt Strikethreatfox

ip:port159.75.123.199:21Cobalt Strikethreatfox

ip:port68.64.183.127:8090Cobalt Strikethreatfox

ip:port68.64.183.127:5555Cobalt Strikethreatfox

ip:port139.196.217.227:80Cobalt Strikethreatfox

ip:port159.75.123.199:5003Cobalt Strikethreatfox

ip:port156.239.47.245:80Cobalt Strikethreatfox

ip:port156.239.47.245:8080Cobalt Strikethreatfox

+1255 indicators in total. See them all on the IOCs page.

References

microsoft.com ↗

Storm-0501 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →