--- title: Azure cloud security: Detect cloud ransomware with... description: Storm-0501, a financially motivated cybercrime group, has shifted from traditional endpoint ransomware to hijacking entire Azure cloud tenants by compromising... canonical: https://daily.dev/posts/azure-cloud-security-detect-cloud-ransomware-with-tenable-one-jehrbrdeg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Azure cloud security: Detect cloud ransomware with Tenable One | daily.dev og:description: Storm-0501, a financially motivated cybercrime group, has shifted from traditional endpoint ransomware to hijacking entire Azure cloud tenants by compromising... og:url: https://daily.dev/posts/azure-cloud-security-detect-cloud-ransomware-with-tenable-one-jehrbrdeg og:image: https://api.daily.dev/og/posts/JehRbRdEG.png og:image:alt: Azure cloud security: Detect cloud ransomware with Tenable One og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Azure cloud security: Detect cloud ransomware with Tenable One **[Tenable Blog](https://daily.dev/sources/tenable-blog)** · 4 min read · 0 upvotes · 0 comments ## Summary Storm-0501, a financially motivated cybercrime group, has shifted from traditional endpoint ransomware to hijacking entire Azure cloud tenants by compromising high-privilege Entra ID identities, disabling resource locks, immutability policies, and backups, then exfiltrating and destroying data for ransom. Tenable One's Cloud Detection and Response (CDR) capabilities aggregate Azure activity logs into AI-powered threat stories mapped to MITRE ATT&CK, helping defenders trace the attack chain and take containment actions such as revoking compromised identities, reverting rogue role assignments, restoring deleted resource locks and backup vaults, and recovering adversary-created encryption keys. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How has the Storm-0501 ransomware group changed its tactics against Azure environments? Storm-0501 has shifted from traditional endpoint encryption to hijacking entire Azure cloud tenants. The group targets the cloud control plane by compromising high-privilege Entra ID Global Administrator identities, then systematically disables Azure Resource Locks, immutability policies, and Recovery Services backup vaults before exfiltrating and destroying data to demand ransom. _daily.dev surfaces cloud security research like this for teams tracking evolving ransomware tactics against Azure._ ### What should I do if a ransomware attacker deletes Azure Resource Locks and backup vaults during a breach? Immediately re-apply resource locks, immutability policies, and Recovery Services vaults to all surviving cloud infrastructure once the alert trail shows they were deleted. Also revoke the attacker's access, restore any soft-deleted encryption keys before the soft-delete window expires, take ownership of any rogue Key Vaults, and re-encrypt data under your own keys. _teams building Azure incident response playbooks can follow cloud security guidance like this on daily.dev._ ### What is cloud detection and response (CDR) and why is it needed for cloud ransomware? Cloud detection and response (CDR) provides full visibility into an attack chain within cloud environments, going beyond endpoint monitoring to identify surgical techniques used by adversaries like Storm-0501. It consolidates fragmented cloud activity logs into a chronological threat story mapped to frameworks like MITRE ATT&CK, letting defenders trace lateral movement and contain fast-moving attacks before data is encrypted or destroyed. _developers evaluating cloud security tooling can compare CDR approaches through daily.dev._ ## Similar posts on daily.dev - [Microsoft Self-Service Password Reset abused in Azure data theft attacks](https://daily.dev/posts/microsoft-self-service-password-reset-abused-in-azure-data-theft-attacks-wzksyvp0l) · BleepingComputer · 0 upvotes · 0 comments - [Threat actors don’t hack in anymore – they log in](https://daily.dev/posts/threat-actors-don-t-hack-in-anymore-they-log-in-vj6wzw3m5) · TechCentral · 1 upvotes · 0 comments - [SPONSORED: The backup Microsoft never promised you](https://daily.dev/posts/sponsored-the-backup-microsoft-never-promised-you-2d1p8xpft) · The Register · 0 upvotes · 0 comments - [Ransomware gang’s slip-up led to data recovery for 12 US firms](https://daily.dev/posts/ransomware-gang-s-slip-up-led-to-data-recovery-for-12-us-firms-ekfv0vyfb) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cloud](https://daily.dev/tags/cloud), [#azure](https://daily.dev/tags/azure), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/azure-cloud-security-detect-cloud-ransomware-with-tenable-one-jehrbrdeg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Azure cloud security: Detect cloud ransomware with Tenable One","url":"https://daily.dev/posts/azure-cloud-security-detect-cloud-ransomware-with-tenable-one-jehrbrdeg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/azure-cloud-security-detect-cloud-ransomware-with-tenable-one-jehrbrdeg"},"datePublished":"2026-08-17T15:16:35.908Z","dateModified":"2026-08-17T15:17:03.849Z","description":"Storm-0501, a financially motivated cybercrime group, has shifted from traditional endpoint ransomware to hijacking entire Azure cloud tenants by compromising...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/74cad24bf8282edb8f39682daf7a36cc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/74cad24bf8282edb8f39682daf7a36cc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Tenable Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Tenable Blog","logo":"https://media.daily.dev/image/upload/s--B6GAvw3H--/f_auto,q_auto/v1780213271/logos/tenable-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/tenable-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/azure-cloud-security-detect-cloud-ransomware-with-tenable-one-jehrbrdeg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cloud,azure,ransomware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tenable Blog","item":"https://daily.dev/sources/tenable-blog"},{"@type":"ListItem","position":3,"name":"Azure cloud security: Detect cloud ransomware with Tenable One"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/azure-cloud-security-detect-cloud-ransomware-with-tenable-one-jehrbrdeg#faq","mainEntity":[{"@type":"Question","name":"How has the Storm-0501 ransomware group changed its tactics against Azure environments?","acceptedAnswer":{"@type":"Answer","text":"Storm-0501 has shifted from traditional endpoint encryption to hijacking entire Azure cloud tenants. The group targets the cloud control plane by compromising high-privilege Entra ID Global Administrator identities, then systematically disables Azure Resource Locks, immutability policies, and Recovery Services backup vaults before exfiltrating and destroying data to demand ransom. daily.dev surfaces cloud security research like this for teams tracking evolving ransomware tactics against Azure."}},{"@type":"Question","name":"What should I do if a ransomware attacker deletes Azure Resource Locks and backup vaults during a breach?","acceptedAnswer":{"@type":"Answer","text":"Immediately re-apply resource locks, immutability policies, and Recovery Services vaults to all surviving cloud infrastructure once the alert trail shows they were deleted. Also revoke the attacker's access, restore any soft-deleted encryption keys before the soft-delete window expires, take ownership of any rogue Key Vaults, and re-encrypt data under your own keys. teams building Azure incident response playbooks can follow cloud security guidance like this on daily.dev."}},{"@type":"Question","name":"What is cloud detection and response (CDR) and why is it needed for cloud ransomware?","acceptedAnswer":{"@type":"Answer","text":"Cloud detection and response (CDR) provides full visibility into an attack chain within cloud environments, going beyond endpoint monitoring to identify surgical techniques used by adversaries like Storm-0501. It consolidates fragmented cloud activity logs into a chronological threat story mapped to frameworks like MITRE ATT&CK, letting defenders trace lateral movement and contain fast-moving attacks before data is encrypted or destroyed. developers evaluating cloud security tooling can compare CDR approaches through daily.dev."}}]} ```