MISP / misp-galaxy

Clusters and elements to attach to MISP events or attributes (like threat actors)
https://misp-galaxy.org/
Other
536 stars 259 forks source link

Create new Threat Actor reference for Storm-0501 #1023

Open forensicdave opened 2 months ago

forensicdave commented 2 months ago

Potential TA Description:

Storm-0501 is a financially motivated cybercriminal group that uses commodity and open-source tools to conduct ransomware operations.

Storm-0501 has been active as early as 2021, initially observed deploying the Sabbath(54bb47h) ransomware in attacks targeting US school districts, publicly leaking data for extortion, and even directly messaging school staff and parents. Since then, most of the threat actor’s attacks have been opportunistic, as the group began operating as a ransomware-as-a-service (RaaS) affiliate deploying multiple ransomware payloads developed and maintained by other threat actors over the years, including Hive, BlackCat (ALPHV), Hunters International, LockBit, and most recently, Embargo ransomware.

Synonyms: SABBATH

External references:

https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/

https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang#:~:text=Sabbath%20is%20a%20mid-sized%20ransomware%20gang