Threat Actor Characterization
Storm-1811
ID: 48b81b9a56420fb7886905f461c80d3557424Actor Network Graph
Open Network GraphMITRE ATT&CK®
Storm-1811 — financially motivated intrusions linked to Black Basta ransomware. Hallmarks: email-bombing to create urgency, IT/help-desk impersonation over Microsoft Teams/voice (vishing), abuse of Quick Assist and RMM tools, BITS/cURL ingress, Impacket/PsExec lateral movement, and selective ransomware deployment.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1667 | Email Bombing | TA0040 | |
| T1566.003 | Spearphishing via Service | TA0001 | |
| T1566.004 | Spearphishing Voice | TA0001 | |
| T1656 | Impersonation | TA0005 |
|
| T1219.002 | Remote Desktop Software | TA0011 |
|
| T1105 | Ingress Tool Transfer | TA0011 | |
| T1059.001 | PowerShell | TA0002 |
|
| T1036.010 | Masquerade Account Name | TA0005 |
|
| T1074.001 | Local Data Staging | TA0009 |
|
| T1048.002 | Exfiltration Over Asymmetric Encrypted Non-C2 Protocol | TA0010 |
|
| T1570 | Lateral Tool Transfer | TA0008 |
|
| T1021.002 | SMB/Windows Admin Shares | TA0008 |
|
| T1486 | Data Encrypted for Impact | TA0040 | |
| T1585.003 | Cloud Accounts | TA0042 |
|
Storm-1811 - Financially motivated intrusions
Executive Summary
Storm-1811 is a financially motivated intrusion set tracked by Microsoft and MITRE (G1046), frequently linked to Black Basta ransomware deployment. The group’s hallmark is a staged social-engineering playbook: overwhelm a user’s mailbox with non-malicious “email-bombing,” then impersonate internal IT via Microsoft Teams or voice calls to secure remote access (often through Quick Assist) and drop RMM tools, loaders, and post-exploitation frameworks. Public reporting also documents AiTM credential theft (e.g., EvilProxy), BITS jobs for tool transfer, and lateral movement culminating in ransomware execution. Overall technical sophistication is moderate but operationally effective due to strong social-engineering tradecraft and rapid “hands-on-keyboard” follow-through. Confidence: high for TTPs, medium for specific victim geographies and sector concentration (vendor-reported).
- Motivation: Profit via data theft + encryption (double extortion) in support of, or overlapping with, Black Basta operations.
- Operating model: Access-brokering and/or direct intrusion team using commodity tools, living-off-the-land, and legitimate collaboration platforms (Teams) as initial-access surfaces.
- Branding: “Storm-1811” is a Microsoft tracking label; some third-party write-ups equate/overlap Storm-1811 with Black Basta operators or “Cardinal/UNC” designations—these mappings vary by vendor (treat cautiously). INFERENCE (confidence: low).