Início / Grupos de ameaça / Storm-0501
Storm-0501 G1053
Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK
4
CVEs associadas
53
Técnicas
8
Malwares e ferramentas
Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, LockBit 3.0, and Embargo ransomware.
Operações de ransomware ligadas a este grupo ransomware.live
embargo via EmbargoVulnerabilidades exploradas
CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.
CVE-2023-4966
Alta · 7.5
KEV Ransomware Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
“Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).”
CVE-2023-38203
Crítica · 9.8
KEV Ransomware Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
“Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).”
CVE-2023-29300
Crítica · 9.8
KEV Ransomware Adobe ColdFusion Deserialization of Untrusted Data Vulnerability
“Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).”
CVE-2022-47966
Crítica · 9.8
KEV Ransomware Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability
“Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).”
Técnicas por tática
Desenvolvimento de recursos
T1587.003 Digital CertificatesT1588.006 Vulnerabilities Acesso inicial
T1078.004 Cloud AccountsT1190 Exploit Public-Facing Application Execução
T1053.005 Scheduled TaskT1059.001 PowerShellT1059.009 Cloud API Persistência
T1053.005 Scheduled TaskT1078.004 Cloud AccountsT1098.001 Additional Cloud CredentialsT1098.003 Additional Cloud RolesT1556.009 Conditional Access Policies Escalada de privilégios
T1053.005 Scheduled TaskT1078.004 Cloud AccountsT1098.001 Additional Cloud CredentialsT1098.003 Additional Cloud RolesT1484.001 Group Policy ModificationT1484.002 Trust Modification Furtividade
T1027.002 Software PackingT1036.004 Masquerade Task or ServiceT1078.004 Cloud AccountsT1218.010 Regsvr32T1218.011 Rundll32 Comprometimento de defesas
T1484.001 Group Policy ModificationT1484.002 Trust ModificationT1556.009 Conditional Access PoliciesT1578.003 Delete Cloud Instance Acesso a credenciais
T1003 OS Credential DumpingT1003.006 DCSyncT1110 Brute ForceT1552.004 Private KeysT1555.005 Password ManagersT1555.006 Cloud Secrets Management StoresT1556.009 Conditional Access Policies Descoberta
T1057 Process DiscoveryT1082 System Information DiscoveryT1087.002 Domain AccountT1087.004 Cloud AccountT1482 Domain Trust DiscoveryT1518.001 Security Software DiscoveryT1526 Cloud Service DiscoveryT1580 Cloud Infrastructure DiscoveryT1614.001 System Language Discovery Movimento lateral
T1021.006 Windows Remote ManagementT1021.007 Cloud Services Coleta
T1530 Data from Cloud Storage Comando e controle
T1219.002 Remote Desktop Software Exfiltração
T1537 Transfer Data to Cloud AccountT1567.002 Exfiltration to Cloud Storage Impacto
T1485 Data DestructionT1486 Data Encrypted for ImpactT1490 Inhibit System RecoveryT1657 Financial Theft Malwares e ferramentas
- Cobalt StrikeMalwareS0154
- EmbargoMalwareS1247
- AADInternalsFerramentaS0677
- ImpacketFerramentaS0357
- NetFerramentaS0039
- NltestFerramentaS0359
- RcloneFerramentaS1040
- TasklistFerramentaS0057
© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.