Storm-1811
- ID
- G1046
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.[1][2][3][4]
Techniques used (31)
- T1021.002 SMB/Windows Admin Shares
- T1021.004 SSH
- T1027.013 Encrypted/Encoded File
- T1033 System Owner/User Discovery
- T1036 Masquerading
- T1036.005 Match Legitimate Resource Name or Location
- T1036.010 Masquerade Account Name
- T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
- T1056 Input Capture
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1074.001 Local Data Staging
- T1087.002 Domain Account
- T1105 Ingress Tool Transfer
- T1140 Deobfuscate/Decode Files or Information
- T1204.002 Malicious File
- T1219.002 Remote Desktop Software
- T1222.001 Windows Permissions
- T1482 Domain Trust Discovery
- T1486 Data Encrypted for Impact
- T1547.001 Registry Run Keys / Startup Folder
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1566.004 Spearphishing Voice
- T1570 Lateral Tool Transfer
- T1574.001 DLL
- T1583.001 Domains
- T1585.003 Cloud Accounts
- T1588.002 Tool
- T1667 Email Bombing
- T1684.001 Impersonation
Software used (7)
- S0029 PsExec
- S0154 Cobalt Strike
- S0190 BITSAdmin
- S0357 Impacket
- S0650 QakBot
- S1070 Black Basta
- S1209 Quick Assist