Storm-1811 — Ransomware Profile
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.Tools & malware
- BITSAdmin LOLBin
- Black Basta Ransomware
- Cobalt Strike Adversary Simulation
- Impacket Network Toolkit
- PsExec Remote Execution
- QakBot Banking Trojan
- Quick Assist Remote Access
Vendor research
- Threat actors misusing Quick Assist in social engineering attacks leading to ransomware Microsoft
- Storm-1811 exploits RMM tools to drop Black Basta ransomware RedCanary
- Intelligence Insights: June 2024 RedCanary
- Ongoing Social Engineering Campaign Linked to Black Basta Ransomware Operators rapid7-email