Storm-1811
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.
- ATT&CK ID
- G1046
- Weather family
- Storm
- Techniques
- 25
- Tools
- 7
Techniques
Resource Development
Acquire InfrastructureEstablish AccountsObtain Capabilities
Initial Access
Execution
Command and Scripting InterpreterUser ExecutionHijack Execution Flow
Persistence
Boot or Logon Autostart Execution
Privilege Escalation
Boot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingDeobfuscate/Decode Files or InformationHijack Execution FlowSocial Engineering
Defense Impairment
File and Directory Permissions Modification
Credential Access
Discovery
System Owner/User DiscoveryAccount DiscoveryDomain Trust Discovery
Lateral Movement
Remote ServicesLateral Tool Transfer
Collection
Command and Control
Ingress Tool TransferRemote Access Tools
Exfiltration
Exfiltration Over Alternative Protocol
Impact
Data Encrypted for ImpactEmail Bombing
Software
BITSAdmin · Black Basta · Cobalt Strike · Impacket · PsExec · QakBot · Quick Assist