Sabbath

Sabbath is a ransomware family active since at least 2021 and associated with ransomware-as-a-service activity. It has been linked to financially motivated intrusion operations, including campaigns attributed to Storm-0501, which used Sabbath in attacks against education organizations in the United States before later expanding to other ransomware payloads. Sabbath is used to encrypt victim files for extortion and has appeared as one of several ransomware options deployed by affiliates during post-compromise operations.

Operationally, Sabbath has been observed in intrusions that involve extensive credential theft, Active Directory and cloud reconnaissance, lateral movement, data exfiltration, and impact actions preceding or accompanying encryption. In Storm-0501-linked activity, ransomware deployment occurred after compromise of on-premises and hybrid cloud environments through exploitation of known public-facing vulnerabilities, brute-force activity, credential dumping, and abuse of administrative access. These operations also included double-extortion behavior, with data theft and pressure on victims in addition to file encryption.

Sabbath is primarily associated with Windows enterprise environments and has been used against sectors including education. Its use in affiliate-driven campaigns places it within a broader ecosystem of commodity post-exploitation tooling, credential access, and extortion-focused intrusion tradecraft.