Researchers at Microsoft have recently warned that threat actor Storm-0501 is now targeting and deploying ransomware in hybrid cloud environments in addition to on-premise environments. Storm-0501 is a ransomware threat actor that has been active since 2021 and has been known to utilize a variety of ransomware strains in their attacks including Hive, BlackCat, LockBit, and Embargo. Embargo ransomware is a Rust-based variety and is provided to threat groups under a ransomware-as-a-service (RaaS) model. Storm-0501 has targeted healthcare, government, transportation, law enforcement, and manufacturing industries in the United States. In recent attack campaigns, the group has expanded their infiltration operations to compromise hybrid cloud environments, exfiltrating data and encrypting systems to demand ransom from victims. Storm-0501 initially gains access to victim organizations either through compromised credentials or exploitation of known vulnerabilities. Once a privileged account in Microsoft’s Entra ID (formerly Azure AD) is compromised, Storm-0501 establishes persistence by creating a new federated domain within the Microsoft Entra tenant. This is also a well-known tactic of the notorious Scatter Spider or “Octo Tempest” threat actor group. After victim data is exfiltrated, the Embargo ransomware payload is deployed using scheduled tasks or Group Policy Objects (GPOs) to encrypt files across devices. The compromise of federated identity access manager to gain access and establish persistence in cloud environments is becoming a more popular tactic amongst threat actors. In Entra ID environments, it is particularly important that organizations monitor authentication and activity of Microsoft Entra Connect Sync accounts, which are used to synchronize data between on-premise and cloud-based Active Directory. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.