[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fc6MhdF0lMkeaWXX85nlR7NkWp4zybe8ijFtYzf4DsA8":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":9,"country":10,"suspected_sponsor":10,"target_industries":11,"target_countries":12,"incident_types":13,"references":14,"techniques":20,"technique_count":21,"created_at":22,"seoMetadata":23,"schemaOrg":27},"Storm-0506","storm-0506",[],"Storm-0506 (DEV-0506) is a financially motivated cybercriminal group operating as a core affiliate within the Black Basta ransomware-as-a-service (RaaS) ecosystem, having switched from deploying Conti ransomware around April 2022. This actor's operational model is distinguished by its strategic reliance on a dynamic network of initial access brokers, showcasing a division of labor common in RaaS operations. Throughout its history, Storm-0506 has leveraged access obtained through various brokers: initially Storm-0450\u002F0464 via Qakbot infections (pre-September 2023), then expanding to include Storm-1674 delivering DarkGate, Pikabot, and IcedID (September 2023), and later employing Storm-1674's Microsoft Teams vishing campaigns (October 2024) and Storm-0569's SEO poisoning leading to BATLOADER and Cobalt Strike (December 2023). Following successful initial compromise, Storm-0506 employs a range of post-exploitation tools, including Cobalt Strike Beacon, SystemBC, and Brute Ratel C4 backdoors, and notably, often utilizes command-and-control (C2) infrastructure established by Storm-0365, indicating close collaboration or shared resources. This actor is characterized by hands-on-keyboard activity, culminating in the deployment of Black Basta ransomware. A resurgence in activity observed in October 2024, directly linked to Storm-1674's vishing, underscores the ongoing and adaptive threat that Storm-0506 represents within the ransomware landscape.",null,[],[],[],[15,16,17,18,19],"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2024\u002F07\u002F29\u002Fransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2023\u002F12\u002F28\u002Ffinancially-motivated-threat-actors-misusing-app-installer\u002F","https:\u002F\u002Fyoutu.be\u002FU7p0J8aMZhM?t=193","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fwdsi\u002Fthreats\u002Fmalware-encyclopedia-description?Name=Exploit:Python\u002FCVE-2024-1709.A!dha&ThreatID=2147903327","https:\u002F\u002Fx.com\u002FMsftSecIntel\u002Fstatus\u002F1849518751080644921",[],0,"2024-08-20T01:15:07.824016+00:00",{"title":24,"metaDescription":25,"keywords":26},"Storm-0506 Threat Actor Profile | EdgeProtect","Storm-0506 (DEV-0506) is a financially motivated cybercriminal group operating as a core affiliate within the Black Basta ransomware-as-a-service (Raa...","Storm-0506, threat actor, APT, cyber threat, threat intelligence",{"@context":28,"@type":29,"name":6,"alternateName":30,"description":9,"url":31,"mainEntityOfPage":32},"https:\u002F\u002Fschema.org","Organization",[],"http:\u002F\u002Flocalhost:3000\u002Fthreat-actors\u002Fstorm-0506",{"@type":33,"@id":31},"WebPage"]