Storm-1811

Overview

Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.

Naming & attribution

Storm-1811 is tracked under 1 names across the industry. It uses 31 documented ATT&CK techniques — more than 67% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1566.004 Spearphishing Voice — used by 1 of 174 groups
• T1585.003 Cloud Accounts — used by 1 of 174 groups
• T1667 Email Bombing — used by 1 of 174 groups
• T1222.001 Windows Permissions — used by 2 of 174 groups
• T1056 Input Capture — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• WIRTE — 12 shared techniques (27% overlap)
• menuPass China — 14 shared techniques (22% overlap)
• APT39 Iran — 14 shared techniques (20% overlap)
• Sidewinder India — 10 shared techniques (20% overlap)
• MuddyWater Iran — 16 shared techniques (19% overlap)
• MirrorFace China — 12 shared techniques (19% overlap)

Capabilities

• Custom malware/implant development — ATT&CK: 3 attributed custom malware families

TTPs — 31 techniques across 12 tactics

Tools & malware (7)

Black Basta · Cobalt Strike · Quick Assist · BITSAdmin · PsExec · Impacket · QakBot

Reporting (3)

• Storm-1811 exploits RMM tools to drop Black Basta ransomware — Red Canary Intelligence
• Intelligence Insights: June 2024 — The Red Canary Team
• Threat actors misusing Quick Assist in social engineering attacks leading to ransomware — Microsoft Threat Intelligence