Threadlinqs IntelligenceStart free

Threat actorRussiaTracked since 2026-03

STORM-0501

Also known as:ALPHVNoberusBlackCatSphynxCodefingerABCD ransomware

As of 2026-08-28, STORM-0501 is a Russia-nexus threat actor tracked by Threadlinqs Intelligence across 3 threats spanning ransomware. Also known as ALPHV, Noberus, BlackCat, Sphynx. ATT&CK coverage spans 33 techniques across 13 tactics in 3 of 3 tracked threats. Most-observed techniques: T1078 (Valid Accounts), T1490 (Inhibit System Recovery), T1685 (Disable or Modify Tools).

Tracked threats
33 high
First seen
2026-03-23
Last seen
2026-06-15
ATT&CK techniques
33across 3 of 3 threats
Related CVEs
0None referenced
Attribution
RussiaNation or origin
Nation: Russia · 3 tracked threat(s) · Categories: RANSOMWARE

Activity timeline

STORM-0501 appears in 3 tracked threats between and ; the busiest month was 2026-06 with 2 reports.

ATT&CK techniques observed

33 techniques observed across 3 of 3 tracked threats · Credential Access (4), Defense Impairment (4), Discovery (4), Impact (4), Persistence (4), Lateral Movement (3)
  • T1078 Valid Accounts — Initial Accessobserved in 3 of 3 tracked threats
  • T1490 Inhibit System Recovery — Impactobserved in 3 of 3 tracked threats
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 3 of 3 tracked threats
  • T1484 Domain or Tenant Policy Modification — Defense Impairmentobserved in 2 of 3 tracked threats
  • T1485 Data Destruction — Impactobserved in 2 of 3 tracked threats
  • T1486 Data Encrypted for Impact — Impactobserved in 2 of 3 tracked threats
  • T1526 Cloud Service Discovery — Discoveryobserved in 2 of 3 tracked threats
  • T1530 Data from Cloud Storage — Collectionobserved in 2 of 3 tracked threats
  • T1537 Transfer Data to Cloud Account — Exfiltrationobserved in 2 of 3 tracked threats
  • T1580 Cloud Infrastructure Discovery — Discoveryobserved in 2 of 3 tracked threats
  • T1657 Financial Theft — Impactobserved in 2 of 3 tracked threats
  • T1003 OS Credential Dumping — Credential Accessobserved in 1 of 3 tracked threats
  • T1003.006 OS Credential Dumping: DCSync — Credential Accessobserved in 1 of 3 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 1 of 3 tracked threats
  • T1021.006 Windows Remote Management — Lateral Movementobserved in 1 of 3 tracked threats

Tracked threats