Threat actor · all actors

Storm-0501G1053 unknown

aka Storm-0501

Last updated: 2026-07-03

0attributed CVEs

62ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[Storm-0501](https://attack.mitre.org/groups/G1053) is a financially motivated cyber criminal group that uses commodity and open-source tools to conduct ransomware operations. [Storm-0501](https://attack.mitre.org/groups/G1053) has been active since 2021 and has previously been affiliated with Sabbath Ransomware and other Ransomware-as-a-Service (RaaS) variants such as Hive, [BlackCat](https://attack.mitre.org/software/S1068), Hunters International, [LockBit 3.0](https://attack.mitre.org/software/S1202), and [Embargo](https://attack.mitre.org/software/S1247) ransomware.(Citation: Avertium Storm-0501 Sabbath Ransomware Arcane January 2022)(Citation: Microsoft Storm-501 Sabbath Ransomware Embargo September 2024)(Citation: Microsoft Storm-0501 Embargo Ransomware August 2025)(Citation: Google Mandiant Storm-0501 Sabbath Ransomware November 2021)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	40 / 62	65%
`AC-3`	38 / 62	61%
`AC-6`	36 / 62	58%
`AC-2`	35 / 62	56%
`CM-6`	31 / 62	50%
`IA-2`	30 / 62	48%
`AC-5`	28 / 62	45%
`CM-7`	27 / 62	44%
`CM-2`	25 / 62	40%
`CM-5`	23 / 62	37%
`SI-7`	21 / 62	34%
`CA-7`	19 / 62	31%
`IA-5`	16 / 62	26%
`AC-4`	15 / 62	24%
`RA-5`	15 / 62	24%

Co-occurring actors

None.