MITRE ATT&CKgroup

G1046 Storm-1811

Published 2025-03-14 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2025-03-14

Description

Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.

Related

Uses · MITRE ATT&CK (38)

  • T1684.001 Impersonation sub-technique
  • T1219.002 Remote Desktop Software sub-technique
  • S1209 Quick Assist software (tool)
  • T1667 Email Bombing technique
  • T1036.010 Masquerade Account Name sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1566.004 Spearphishing Voice sub-technique
  • S1070 Black Basta software (malware)
  • T1585.003 Cloud Accounts sub-technique
  • S0650 QakBot software (malware)
  • T1588.002 Tool sub-technique
  • T1583.001 Domains sub-technique
  • T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1574.001 DLL sub-technique
  • T1204.002 Malicious File sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1566.003 Spearphishing via Service sub-technique
  • T1087.002 Domain Account sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1021.004 SSH sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1222.001 Windows Permissions sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1486 Data Encrypted for Impact technique
  • T1482 Domain Trust Discovery technique
  • S0357 Impacket software (tool)
Show all 38 ›

References