Home / Threat actors / Storm-1811
Storm-1811 G1046
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
34
Techniques
7
Malware and tools
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.
Ransomware operations linked to this group ransomware.live
blackbasta via Black BastaExploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Resource Development
T1583.001 DomainsT1585.003 Cloud AccountsT1588.002 Tool Initial Access
T1566.002 Spearphishing LinkT1566.003 Spearphishing via ServiceT1566.004 Spearphishing Voice Execution
T1059.001 PowerShellT1059.003 Windows Command ShellT1204.002 Malicious FileT1574.001 DLL Persistence
T1547.001 Registry Run Keys / Startup Folder Privilege Escalation
T1547.001 Registry Run Keys / Startup Folder Stealth
T1027.013 Encrypted/Encoded FileT1036 MasqueradingT1036.005 Match Legitimate Resource Name or LocationT1036.010 Masquerade Account NameT1140 Deobfuscate/Decode Files or InformationT1574.001 DLLT1684.001 Impersonation Defense Impairment
T1222.001 Windows Permissions Credential Access
T1056 Input Capture Discovery
T1033 System Owner/User DiscoveryT1087.002 Domain AccountT1482 Domain Trust Discovery Lateral Movement
T1021.002 SMB/Windows Admin SharesT1021.004 SSHT1570 Lateral Tool Transfer Collection
T1056 Input CaptureT1074.001 Local Data Staging Command and Control
T1105 Ingress Tool TransferT1219.002 Remote Desktop Software Exfiltration
T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol Impact
T1486 Data Encrypted for ImpactT1667 Email Bombing Malware and tools
- Black BastaMalwareS1070
- Cobalt StrikeMalwareS0154
- QakBotMalwareS0650
- BITSAdminToolS0190
- ImpacketToolS0357
- PsExecToolS0029
- Quick AssistToolS1209
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.