Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Storm-0501 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

Storm-0501

MITRE G1053 ↗

Storm-0501 — ATT&CK roseST

attack rose · 42 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE4 new CVEs: CVE-2022-47966, CVE-2023-29300, CVE-2023-38203, CVE-2023-4966

Analyst brief

misp-galaxy + mitre-attack

Storm-0501 is a financially motivated cybercriminal group that has been active since 2021, initially targeting US school districts with the Sabbath ransomware and later transitioning to a RaaS model deploying various ransomware strains, including Embargo. The group exploits weak credentials and over-privileged accounts to achieve lateral movement from on-premises environments to cloud infrastructures, establishing persistent backdoor access and deploying ransomware. They have utilized techniques such as credential theft, exploiting vulnerabilities in Zoho ManageEngine and Citrix NetScaler, and employing tools like Cobalt Strike and Rclone for lateral movement and data exfiltration. Storm-0501 has specifically targeted sectors such as government, manufacturing, transportation, and law enforcement in the United States.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

42 techniques · 13 of 15 tactics

  1. Resource development

    2 techniques

  2. Initial access

    1 technique

  3. Execution

    3 techniques

  4. Persistence

    2 techniques

  5. Stealth

    5 techniques

  6. Defense impairment

    4 techniques

  7. Credential access

    6 techniques

  8. Discovery

    9 techniques

  9. Lateral movement

    2 techniques

  10. Collection

    1 technique

  11. Command and control

    1 technique

  12. Exfiltration

    2 techniques

  13. Impact

    4 techniques

select a technique

Arsenal

2 malware · 6 tools
Malware
Malware · 2ATT&CK
Cobalt StrikeS0154 ↗
EmbargoS1247 ↗
Tools
Tools · 6ATT&CK
ImpacketS0357 ↗
TasklistS0057 ↗
RcloneS1040 ↗
NltestS0359 ↗
NetS0039 ↗
AADInternalsS0677 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs Storm-0501 is cited as exploiting

none on KEV
  1. CVE-2023-293002026-10-17
    1. “In a recent campaign, Storm-0501 exploited known vulnerabilities in Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler (CVE-2023-4966), and ColdFusion 2016 application (possibly CVE-2023-29300 or CVE-2023-38203).”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “Citrix NetScaler "Citrix Bleed" (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203). [2] Enterprise T1657”

      cited as exploiting · named nearby · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2023-382032026-10-17
    1. “In a recent campaign, Storm-0501 exploited known vulnerabilities in Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler (CVE-2023-4966), and ColdFusion 2016 application (possibly CVE-2023-29300 or CVE-2023-38203).”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “Citrix NetScaler "Citrix Bleed" (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203). [2] Enterprise T1657”

      cited as exploiting · named nearby · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2023-49662026-10-17
    1. “In a recent campaign, Storm-0501 exploited known vulnerabilities in Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler (CVE-2023-4966), and ColdFusion 2016 application (possibly CVE-2023-29300 or CVE-2023-38203).”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler "Citrix Bleed" (CVE-2023-4966)”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  4. CVE-2022-479662026-10-17
    1. “In a recent campaign, Storm-0501 exploited known vulnerabilities in Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler (CVE-2023-4966), and ColdFusion 2016 application (possibly CVE-2023-29300 or CVE-2023-38203).”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966)”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

5 sources
  1. 1.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-a…
  2. 2.attack.mitre.org/groups/G1053
  3. 3.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-rans…
  4. 4.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-te…
  5. 5.cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-aff…

Track Storm-0501 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.