Introduction
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake “help desk” interaction leading to the deployment of adversary tools and capabilities. Microsoft Storm-1811 2024 rapid7-email-bombing RedCanary Storm-1811 2024 RedCanary June Insights 2024
Activities and Tactics
Information pending cataloguing.
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
- T1585.003 Cloud Accounts
- T1074.001 Local Data Staging
- T1667 Email Bombing
- T1547.001 Registry Run Keys / Startup Folder
- T1583.001 Domains
- T1036.005 Match Legitimate Resource Name or Location
- T1588.002 Tool
- T1219.002 Remote Desktop Software
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1140 Deobfuscate/Decode Files or Information
- T1036.010 Masquerade Account Name
- T1056 Input Capture
- T1574.001 DLL
- T1204.002 Malicious File
- T1566.004 Spearphishing Voice
- T1027.013 Encrypted/Encoded File
- T1684.001 Impersonation
- T1105 Ingress Tool Transfer
- T1570 Lateral Tool Transfer
- T1021.004 SSH
- T1486 Data Encrypted for Impact
- T1036 Masquerading
- T1482 Domain Trust Discovery
- T1566.003 Spearphishing via Service
- T1566.002 Spearphishing Link
- T1087.002 Domain Account
- T1033 System Owner/User Discovery
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1222.001 Windows Permissions
- T1021.002 SMB/Windows Admin Shares
ATT&CK technique IDs (denormalized)
- T1021.002
- T1021.004
- T1027.013
- T1033
- T1036
- T1036.005
- T1036.010
- T1048.002
- T1056
- T1059.001
- T1059.003
- T1074.001
- T1087.002
- T1105
- T1140
- T1204.002
- T1219.002
- T1222.001
- T1482
- T1486
- T1547.001
- T1566.002
- T1566.003
- T1566.004
- T1570
- T1574.001
- T1583.001
- T1585.003
- T1588.002
- T1667
- T1684.001
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
MITRE ATT&CK Software
- Black Basta (S1070) — malware
- Cobalt Strike (S0154) — malware
- Quick Assist (S1209) — tool
- BITSAdmin (S0190) — tool
- PsExec (S0029) — tool
- Impacket (S0357) — tool
- QakBot (S0650) — malware
Attribution and Evidence
Information pending cataloguing.
References
[1] mitre-attack [2] Microsoft Storm-1811 2024 Microsoft Threat Intelligence. (2024, May 15). Threat actors misusing Quick Assist in social engineering attacks leading to ransomware. Retrieved March 14, 2025. [3] RedCanary Storm-1811 2024 Red Canary Intelligence. (2024, December 2). Storm-1811 exploits RMM tools to drop Black Basta ransomware. Retrieved March 14, 2025. [4] RedCanary June Insights 2024 The Red Canary Team. (2024, June 20). Intelligence Insights: June 2024. Retrieved March 14, 2025. [5] rapid7-email-bombing Tyler McGraw, Thomas Elkins, and Evan McCann. (2024, May 10). Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators. Retrieved January 31, 2025.