Storm-1811

Storm-1811 is a financially motivated threat actor tracked by Microsoft. It has been active since at least 2022 and is known for social engineering-based initial access, particularly impersonating help desk or IT support personnel via phone calls and Microsoft Teams. Reported activity commonly involves email bombing followed by contact from the actor, then persuading victims to grant remote access through remote monitoring and management tools, especially Microsoft Quick Assist, and in some cases AnyDesk or TeamViewer. Microsoft reported Storm-1811 using Teams and Quick Assist in 2024, including use of generic tenant display names such as "Help Desk," "Help Desk IT," "Help Desk Support," and "IT Support." The actor is associated with ransomware intrusion activity and has been reported as gaining initial access for groups including UNC2500, UNC2633, and UNC5155 to distribute ransomware such as Black Basta and 3 AM. Microsoft states Storm-1811 is known to deploy Black Basta ransomware. Red Canary reported likely Storm-1811 activity progressing from remote access to reconnaissance, lateral movement, establishment of an SSH tunnel backdoor, and ultimately Black Basta deployment if not contained. Sophos reported that STAC5777 overlaps with Storm-1811 and linked related tradecraft to 3AM ransomware activity and Black Basta-affiliated vishing operations. Observed tradecraft in the provided content includes PowerShell execution; use of multiple batch scripts during initial access and follow-on activity; prompting users to execute downloaded software and payloads; distribution of password-protected ZIP archives; acquisition and use of legitimate and malicious tools including RMM software and commodity malware; creation of Windows Registry Run keys for persistence; staging captured credentials locally for later manual exfiltration; and use of a Cobalt Strike installer disguised as a malicious DLL masquerading as part of a legitimate 7zip installation package. The Cobalt Strike payload was described as XOR-encoded in a DLL and decoded with a hardcoded key when invoked by a legitimate 7zip installation process. Known aliases in the provided content are Curly Spider and Storm-1811. Sophos also reported overlap between Storm-1811 and the cluster STAC5777.