Home / Threat actors / Storm-0501
Storm-0501 G1053
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
4
associated CVEs
53
Techniques
8
Malware and tools
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.
Ransomware operations linked to this group ransomware.live
embargo via EmbargoExploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
CVE-2023-4966
High · 7.5
KEV Ransomware Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
“Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).”
CVE-2023-38203
Critical · 9.8
KEV Ransomware Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
“Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).”
CVE-2023-29300
Critical · 9.8
KEV Ransomware Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
“Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).”
CVE-2022-47966
Critical · 9.8
KEV Ransomware Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
“Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).”
Techniques by tactic
Resource Development
T1587.003 Digital CertificatesT1588.006 Vulnerabilities Initial Access
T1078.004 Cloud AccountsT1190 Exploit Public-Facing Application Execution
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.009 Cloud API Persistence
T1053.005 Scheduled TaskT1078.004 Cloud AccountsT1098.001 Additional Cloud CredentialsT1098.003 Additional Cloud RolesT1556.009 Conditional Access Policies Privilege Escalation
T1053.005 Scheduled TaskT1078.004 Cloud AccountsT1098.001 Additional Cloud CredentialsT1098.003 Additional Cloud RolesT1484.001 Group Policy ModificationT1484.002 Trust Modification Stealth
T1027.002 Software PackingT1036.004 Masquerade Task or ServiceT1078.004 Cloud AccountsT1218.010 Regsvr32T1218.011 Rundll32 Defense Impairment
T1484.001 Group Policy ModificationT1484.002 Trust ModificationT1556.009 Conditional Access PoliciesT1578.003 Delete Cloud Instance Credential Access
T1003 OS Credential DumpingT1003.006 DCSyncT1110 Brute ForceT1552.004 Private KeysT1555.005 Password ManagersT1555.006 Cloud Secrets Management StoresT1556.009 Conditional Access Policies Discovery
T1057 Process DiscoveryT1082 System Information DiscoveryT1087.002 Domain AccountT1087.004 Cloud AccountT1482 Domain Trust DiscoveryT1518.001 Security Software DiscoveryT1526 Cloud Service DiscoveryT1580 Cloud Infrastructure DiscoveryT1614.001 System Language Discovery Lateral Movement
T1021.006 Windows Remote ManagementT1021.007 Cloud Services Collection
T1530 Data from Cloud Storage Command and Control
T1219.002 Remote Desktop Software Exfiltration
T1537 Transfer Data to Cloud AccountT1567.002 Exfiltration to Cloud Storage Impact
T1485 Data DestructionT1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1657 Financial Theft Malware and tools
- Cobalt StrikeMalwareS0154
- EmbargoMalwareS1247
- AADInternalsToolS0677
- ImpacketToolS0357
- NetToolS0039
- NltestToolS0359
- RcloneToolS1040
- TasklistToolS0057
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.