Microsoft Threat Intelligence Podcast Open SesameOp: Abusing trusted AI platforms to host a C2 server
8 snips
Jan 14, 2026 Join threat experts Jonathan Checchi and Anna Seitz as they delve into the dangerous world of cloud-native ransomware. Jonathan explores how Storm-0501 has evolved its tactics, leveraging hybrid cloud environments to maximize impact. Meanwhile, Anna reveals the insidious SesameOp backdoor, which abuses trusted AI platforms for covert command-and-control operations. The conversation highlights the importance of monitoring identity behavior and implementing robust defenses like MFA to combat these sophisticated threats.
AI Snips
Chapters
Transcript
Episode notes
Ransomware Growing Up In The Cloud
- Cloud-native ransomware uses cloud control planes and identity rather than traditional malware.
- This expands attackers' impact radius across cloud and on-premise systems quickly.
Storm 0501's Evolution Timeline
- Jonathan traces Storm 0501's evolution from Sabbath to BlackCat and cloud-native tactics.
- The group shifted from on‑prem ransomware to exfiltrate-and-destroy cloud strategies in 2025.
Hybrid Pivot Points Are High Value Targets
- Hybrid cloud pivot points expose highly valuable, fragile on-prem systems to cloud-era attacks.
- Attackers leverage identity to pivot between on‑prem and cloud for rapid, high-impact operations.