Detecting cloud ransomware in Azure with Tenable One’s cloud detection and response capabilities

1. Executive summary

The threat actor Storm-0501 (MITRE G1053) is actively conducting cloud ransomware campaigns targeting Microsoft Azure environments. The group has shifted from traditional endpoint encryption to hijacking cloud control planes by compromising high-privilege administrative identities in Microsoft Entra ID, weaponizing native cloud tools, and dismantling defensive controls including resource locks, immutability policies, and backups. EMEA financial services running hybrid Active Directory and Azure workloads are exposed to total tenant compromise, data exfiltration, and destructive ransomware impact. This advisory is based on a single-source vendor blog post from Tenable; verify TTPs against your own telemetry before enforcement.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution note: Storm-0501 is confirmed as MITRE G1053. The TTPs described below are single-sourced from Tenable's vendor blog, which references Microsoft's 2024 observations. No independent corroboration is available in the provided source material.

Confirmed attack chain

1. Initial access / identity compromise: Storm-0501 bridges on-premises Active Directory with cloud-native Microsoft Entra ID. The group compromises a high-privilege administrative identity — specifically targeting the Entra ID Global Administrator role — to gain control of the cloud control plane. The exact initial access vector (phishing, token theft, AD federation compromise) is not specified in the source material.
2. Privilege escalation & native tool weaponization: Rather than deploying traditional malware, the group weaponizes native Azure cloud tools to operate from within the tenant. No custom binaries are required; the attack leverages legitimate cloud APIs and administrative functions.
3. Defensive evasion & barrier dismantling: Storm-0501 systematically neutralizes cloud defensive controls: - Resource locks on Azure resources are removed or bypassed. - Immutability policies on storage containers are disabled or circumvented. - Data backups are destroyed.
4. Data exfiltration & destruction: The group uses cloud-native capabilities to exfiltrate data and destroy remaining data, then demands ransom payments. The source does not specify specific exfiltration methods, tooling, or ransom demands.
5. Tenant-wide impact: The end state is compromise of the entire Azure cloud tenant "from the inside out," with encryption, exfiltration, and destruction of critical data.

Key technical observations

• The attack is detectable through Azure activity logs, which Tenable One aggregates into a chronological threat story mapped to MITRE ATT&CK.
• Critical detection surface includes: Entra ID Global Administrator role-assignment events, resource lock configuration changes, immutability policy modifications, and backup deletion events.
• The group demonstrates proficiency in operating across the hybrid AD / Entra ID boundary, indicating federation or sync infrastructure is in scope.

4. Mitigation & containment

P1 — Within 24 hours

• Audit Entra ID Global Administrator assignments: Review all accounts holding Global Admin role. Reduce to absolute minimum. Identify any accounts created or modified outside change management.
• Revoke compromised identities (if active incident): Terminate all active sessions, revoke refresh tokens, and rotate credentials for any compromised Global Administrator accounts. Use Tenable One's events explorer dashboard to trace role-assignment events and identify the initial breach point.
• Alert on defensive-control tampering: Create Azure Monitor / Sentinel alerts for:
• Deletion or modification of resource locks (Microsoft.Resources/deleteLocks/action)
• Removal or modification of immutability policies on storage containers
• Bulk deletion of backup items or backup vaults
• Verify backup integrity: Confirm that Azure Backup and any third-party backup solutions retain valid, restorable copies. Validate that immutability controls are enforced and have not been tampered with.

P2 — Within 72 hours

• Review hybrid AD trust boundaries: Assess the federation and sync paths between on-premises Active Directory and Entra ID. Storm-0501 bridges these environments — ensure AD Connect, federation trusts, and pass-through authentication are hardened and monitored.
• Implement Privileged Identity Management (PIM): Move standing Global Administrator assignments to just-in-time access via Entra ID PIM. Require MFA and approval workflows for activation.
• Enable Azure activity log forwarding: Ensure all Azure activity logs, Entra ID sign-in logs, and audit logs are forwarded to a SIEM or centralized log repository for continuous monitoring. Tenable One CDR can aggregate these into threat stories.

P3 — Within 7 days

• Conduct a cloud control-plane compromise exercise: Run a tabletop or purple-team exercise simulating Storm-0501's TTPs — Global Admin compromise, resource lock removal, backup destruction — to validate detection and response readiness. This aligns with DORA Art. 24 resilience testing requirements.
• Review third-party / managed identity permissions: Audit all service principals, managed identities, and third-party application registrations for excessive Azure RBAC roles. Strip any with Owner or Contributor at subscription or management-group scope.

5. Indicators of compromise

No atomic indicators of compromise (IPs, domains, hashes, file paths) are available in the source material. The source describes observable behaviours only.

Behavioural indicators

6. Detection

The source material describes behavioural patterns observable in Azure activity logs but does not provide specific command-line strings, file artefacts, mutex names, or other threat artefacts suitable for YARA rules. The following Sigma rule targets the specific behaviours named in the source: Global Administrator role assignment anomalies, resource lock deletion, and immutability policy removal.

title: Storm-0501 Cloud Ransomware Behaviours in Azure
id: 7a3c1f2e-8b4d-4e6a-9c5f-1d2e3f4a5b6c
status: experimental
description: >
  Detects behaviours consistent with Storm-0501 cloud ransomware campaigns:
  Global Admin role assignment, resource lock deletion, immutability policy
  removal, and backup destruction in Azure environments.
references:

  - https://www.tenable.com/blog/detecting-cloud-ransomware-in-azure-with-tenable-ones-cloud-detection-and-response
author: Adverse Trace
date: 2026/08/17
tags:

  - attack.persistence
  - attack.privilege_escalation
  - attack.impact
  - attack.t1098
  - attack.t1485
logsource:
  product: azure
  service: activitylogs
detection:
  global_admin_assignment:
    operationName|contains:

      - 'Add role member to role'
    properties.roleName|contains:

      - 'Global Administrator'
  resource_lock_deletion:
    operationName|contains:

      - 'Microsoft.Authorization/locks/delete'
      - 'Microsoft.Resources/deleteLocks/action'
  immutability_policy_removal:
    operationName|contains:

      - 'Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies/delete'
  backup_deletion:
    operationName|contains:

      - 'Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems/delete'
      - 'Microsoft.DataProtection/backupVaults/backupInstances/delete'
  condition: global_admin_assignment or resource_lock_deletion or immutability_policy_removal or backup_deletion
falsepositives:

  - Legitimate administrative role changes during approved change windows
  - Planned resource lock removal during infrastructure decommissioning
  - Backup lifecycle management operations
level: high

Threat actor context

Storm-0501 · G1053

Storm-0501 is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. Storm-0501 has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, BlackCat, Hunters International, [LockBit 3.0](https://atta …

7. Sources

• Tenable, "Detecting cloud ransomware in Azure with Tenable One's cloud detection and response capabilities," https://www.tenable.com/blog/detecting-cloud-ransomware-in-azure-with-tenable-ones-cloud-detection-and-response, 2026-08-17

8. Adverse Trace position

Storm-0501 (MITRE G1053) represents a confirmed and tactically significant shift from endpoint ransomware to cloud control-plane compromise in Azure. The attack chain — hijacking Entra ID Global Administrator, neutralizing resource locks and immutability policies, and destroying backups — is specifically designed to defeat standard cloud resilience controls and is directly relevant to EMEA financial services with hybrid AD/Azure estates. The severity is high for any organization with standing Global Administrator privileges and inadequate monitoring of Azure activity logs. Confidence caveat: this advisory is single-sourced from a Tenable vendor blog; the TTPs are plausible and consistent with Microsoft's 2024 reporting referenced therein, but we have not independently corroborated the specific technical details. We will update this advisory if additional source material becomes available. Clients should prioritize P1 actions immediately and validate detection coverage using the Sigma rule in §6.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.