THREAT_ACTOR · G1046
Storm-1811
Also known as: Storm-1811
Profile
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.
MITRE ATT&CK ↗Techniques
31 ATT&CK techniques attributed to this actor.
T1021.002 SMB/Windows Admin SharesT1021.004 SSHT1027.013 Encrypted/Encoded FileT1033 System Owner/User DiscoveryT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1036.010 Masquerade Account NameT1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 ProtocolT1056 Input CaptureT1059.001 PowerShellT1059.003 Windows Command ShellT1074.001 Local Data StagingT1087.002 Domain AccountT1105 Ingress Tool TransferT1140 Deobfuscate/Decode Files or InformationT1204.002 Malicious FileT1219.002 Remote Desktop SoftwareT1222.001 Windows PermissionsT1482 Domain Trust DiscoveryT1486 Data Encrypted for ImpactT1547.001 Registry Run Keys / Startup FolderT1566.002 Spearphishing LinkT1566.003 Spearphishing via ServiceT1566.004 Spearphishing VoiceT1570 Lateral Tool TransferT1574.001 DLLT1583.001 DomainsT1585.003 Cloud AccountsT1588.002 ToolT1667 Email BombingT1684.001 Impersonation
Software
7 malware/tools attributed to this actor.
PsExecCobalt StrikeBITSAdminImpacketQakBotBlack BastaQuick Assist
Related corpus activity
9,980 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Storm-1811.
| Indicator | Type | Family | Sev | Src |
|---|---|---|---|---|
| cve-2020-17456 | cve | — | 85 | 1 |
| cve-2025-12057 | cve | — | 85 | 1 |
| cve-2016-15047 | cve | — | 85 | 4 |
| cve-2021-4045 | cve | — | 85 | 1 |
| cve-2013-7471 | cve | — | 85 | 1 |
| cve-2026-3844 | cve | — | 85 | 1 |
| cve-2025-0921 | cve | — | 85 | 2 |
| cve-2025-68670 | cve | — | 85 | 2 |
| cve-2018-8007 | cve | — | 85 | 1 |
| cve-2023-44976 | cve | ransomware | 85 | 2 |
| cve-2025-2492 | cve | — | 85 | 2 |
| cve-2017-18377 | cve | — | 85 | 1 |
| cve-2026-1969 | cve | — | 85 | 1 |
| cve-2026-0740 | cve | — | 85 | 1 |
| cve-2025-66478 | cve | — | 85 | 2 |
| cve-2022-47945 | cve | — | 85 | 1 |
| cve-2026-22584 | cve | — | 85 | 2 |
| cve-2021-27076 | cve | — | 85 | 1 |
| cve-2025-34054 | cve | — | 85 | 4 |
| cve-2024-1781 | cve | — | 85 | 1 |
| cve-2014-2321 | cve | — | 85 | 1 |
| cve-2026-3102 | cve | — | 85 | 3 |
| cve-2020-22653 | cve | — | 85 | 2 |
| cve-2020-22658 | cve | — | 85 | 2 |
| cve-2025-34117 | cve | — | 85 | 1 |
| cve-2026-4368 | cve | ransomware | 85 | 1 |
| cve-2021-25646 | cve | — | 85 | 1 |
| cve-2021-29441 | cve | — | 85 | 1 |
| cve-2025-23304 | cve | — | 85 | 2 |
| cve-2025-34085 | cve | — | 85 | 1 |
Showing the top 30 by severity of 9,980.