Storm-0506

Storm-0506 is a Microsoft-tracked, financially motivated ransomware operator associated with Black Basta ransomware deployment. Microsoft observed Storm-0506 in intrusions that culminated in Black Basta deployment, including a North American engineering firm where initial access was obtained via Qakbot, followed by exploitation of CVE-2023-28252 for privilege escalation, use of Cobalt Strike and Pypykatz to steal domain administrator credentials, lateral movement to domain controllers, persistence via custom tools and SystemBC, attempted RDP brute forcing, and use of PsExec to encrypt non-ESXi devices. Microsoft also observed Storm-0506 exploiting CVE-2024-37085 on domain-joined VMware ESXi environments by creating the "ESX Admins" Active Directory group and adding a user to obtain full administrative access, enabling ESXi filesystem encryption and disruption of hosted virtual machines. Microsoft reported that this post-compromise technique has led to Akira and Black Basta ransomware deployments by Storm-0506 and other ransomware operators. Storm-0506 has also been linked to handoffs from access broker Storm-0569; in one observed case, Storm-0569’s BATLOADER infection chain led to Cobalt Strike Beacon deployment, Rclone data exfiltration, and subsequent Black Basta ransomware deployment by Storm-0506. One mention context also states Storm-0506 targeted enterprise collaboration tools in past espionage campaigns, but the supporting content primarily characterizes the actor as a ransomware operator. Known alias in the provided content: storm_0506.