ATT&CK ReferencesAvertium Storm-0501 Sabbath Ransomware Arcane January 2022

Avertium Storm-0501 Sabbath Ransomware Arcane January 2022

Avertium. (2022, January 11). An In-Depth Look at Ransomware Gang, Sabbath. Retrieved October 19, 2025.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1614.001 System Language Discovery	GroupStorm-0501	Storm-0501 has identified system language codes on a compromised host to determine if the victim falls under a non-supported language code that is prohibited for targeting, including victims associated with Russia and other Commonwealth of Independent States (CIS) that may draw attention of law enforcement in countries where the ransomware operator or affiliates may reside/operate from. Avertium Storm-0501 Sabbath Ransomware Arcane January 2022 Google Mandiant Storm-0501 Sabbath Ransomware November 2021
T1657 Financial Theft	GroupStorm-0501	Storm-0501 has engaged in double-extortion ransomware, exfiltrating data and directly contacting victims when the primary organization refuses to pay along with posting data on their data leak sites. Avertium Storm-0501 Sabbath Ransomware Arcane January 2022 Google Mandiant Storm-0501 Sabbath Ransomware November 2021 Microsoft Storm-0501 Embargo Ransomware August 2025

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.