Loading threat actor…
Storm-0506 is a Microsoft-tracked financially motivated ransomware operator associated with Black Basta deployments. The actor has been observed in post-compromise operations that culminate in data theft, disruption of virtualized infrastructure, and ransomware execution, including attacks against VMware ESXi environments. Storm-0506 has been linked to exploitation of CVE-2024-37085 on domain-joined ESXi hypervisors, where abuse of the ESX Admins group mechanism enabled full administrative access and subsequent encryption of the ESXi file system, disrupting hosted virtual machines. Observed Storm-0506 intrusions include a North American engineering firm in which initial access followed a Qakbot infection, privilege escalation was achieved via CVE-2023-28252, credentials were stolen with tooling including Pypykatz, and Cobalt Strike was used during post-exploitation. The actor moved laterally to domain controllers, established persistence with custom tooling and SystemBC, attempted brute-force RDP access to additional systems, created an ESX Admins group to gain hypervisor control, and used PsExec to expand encryption to non-ESXi devices. Microsoft has also reported Storm-0506 receiving access from intrusion brokers such as Storm-0569 and Storm-1674, with observed chains involving BATLOADER, Cobalt Strike, Rclone-based exfiltration, and eventual Black Basta ransomware deployment. Storm-0506’s operations are consistent with human-operated ransomware tradecraft: credential theft, privilege escalation, lateral movement, persistence, data exfiltration, and large-scale encryption. The actor has been associated with exploitation of exposed enterprise infrastructure and with operational patterns that align closely with Black Basta ransomware activity. Reporting also notes historical targeting of enterprise collaboration tools in espionage campaigns, but the strongest corroborated characterization in the available evidence is as a financially motivated ransomware actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
11 malware families attributed to this actor across reporting.
6 additional families tracked in Mallory.
3 CVEs this actor has used in observed campaigns. 3 of them exploited in the wild.
The threat actor gained initial access to the organization via Qakbot infection, followed by the exploitation of a Windows CLFS vulnerability (CVE-2023-28252) to elevate their privileges on affected devices.
The vulnerability, identified as CVE-2024-37085, involves a domain group whose members are granted full administrative access to the ESXi hypervisor by default without proper validation... VMware ESXi hypervisors joined to an Active Directory domain consider any member of a domain group named “ESX Admins” to have full administrative access by default.
A newly disclosed vulnerability, CVE-2025-53770, affecting on-premises Microsoft SharePoint Server, enables unauthenticated remote code execution (RCE) through insecure deserialization of untrusted data... Microsoft has confirmed that public exploits are available and actively being used by threat actors.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed only as a source/reference, not discussed as part of the event itself.
Activity cluster observed using CVE-2024-37085 in an ESXi/AD context to enable deployment of Black Basta ransomware.
Cited as a possible actor based on historical TTPs; previously associated (per the article) with targeting enterprise collaboration tools in espionage-oriented activity, and potentially relevant to SharePoint exploitation of CVE-2025-53770.
Storm-0506 is involved in ransomware campaigns exploiting VMware ESXi authentication bypass vulnerabilities to deploy Akira and Black Basta ransomware, leading to data theft and operational disruption.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.