Ankura CTIX FLASH Update - October 1, 2024

Ransomware/Malware Activity

Storm-0501 Releases Embargo Ransomware in Cloud Environments

Researchers at Microsoft have recently warned that threat actor Storm-0501 is now targeting and deploying ransomware in hybrid cloud environments in addition to on-premise environments. Storm-0501 is a ransomware threat actor that has been active since 2021 and has been known to utilize a variety of ransomware strains in their attacks including Hive, BlackCat, LockBit, and Embargo. Embargo ransomware is a Rust-based variety and is provided to threat groups under a ransomware-as-a-service (RaaS) model. Storm-0501 has targeted healthcare, government, transportation, law enforcement, and manufacturing industries in the United States. In recent attack campaigns, the group has expanded their infiltration operations to compromise hybrid cloud environments, exfiltrating data and encrypting systems to demand ransom from victims. Storm-0501 initially gains access to victim