216.73.217.22

Storm-1811

· Published 16/12/2025 19:39 · Modified 27/03/2026 01:13 · Source: The MITRE Corporation

Essential information

Confidence
100/100
Published
16/12/2025 19:39
Modified
27/03/2026 01:13
Updated at
27/03/2026 01:13
Revoked
No
Author / Source
The MITRE Corporation
Resource level
—
Primary motivation
—
Related entities
1 reports, 40 attack patterns (mitre), 5 malware, 12 indicators, 4 tool

Description

[Storm-1811](https://attack.mitre.org/groups/G1046) is a financially-motivated entity linked to [Black Basta](https://attack.mitre.org/software/S1070) ransomware deployment. [Storm-1811](https://attack.mitre.org/groups/G1046) is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.(Citation: Microsoft Storm-1811 2024)(Citation: rapid7-email-bombing)(Citation: RedCanary Storm-1811 2024)(Citation: RedCanary June Insights 2024)

Marking (TLP)

TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.

External references

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (40)

Malware (5)

  • QakBot uses
    Family
    Published 30/05/2024 14:20 · Modified 30/05/2024 14:20
  • Cobalt Strike uses
    Family
    Published 16/12/2024 14:25 · Modified 16/12/2024 14:25
  • Black Basta uses
    Family The MITRE Corporation Confidence 100

    [Black Basta](https://attack.mitre.org/software/S1070) is ransomware written in C++ that has been offered within the ransomware-as-a-service (RaaS) model since at least April 2022; there are variants that target Windows and …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 08/03/2023 20:14 · Modified 27/03/2026 01:05
  • QakBot - S0650 uses
    Family
    Published 01/04/2025 14:48 · Modified 01/04/2025 14:48
  • Black Basta - S1070 uses
    Family
    Published 05/02/2026 20:21 · Modified 05/02/2026 20:21

Indicators (12)

  • greekpool.com indicates
  • upd7a.com indicates
  • 93058bd5fe5f046e298e1d3655274ae4c08f07a8b6876e61629ae4a0b510a2f7 indicates
  • 0f9156f91c387e7781603ed716dcdc3f5342ece96e155115708b1662b0f9b4d0 indicates
  • 1cb1864314262e71de1565e198193877ef83e98823a7da81eb3d59894b5a4cfb indicates
  • zziveastnews.com indicates
  • upd7.com indicates
  • realsepnews.com indicates
  • upd5.pro indicates
  • 1ad05a4a849d7ed09e2efb38f5424523651baf3326b5f95e05f6726f564ccc30 indicates
  • upd9.com indicates
  • 71d50b74f81d27feefbc2bc0f631b0ed7fcdf88b1abbd6d104e66638993786f8 indicates

Tool (4)

  • Quick Assist uses
    The MITRE Corporation Confidence 100

    [Quick Assist](https://attack.mitre.org/software/S1209) is a remote assistance tool primarily for Microsoft Windows, although a macOS version also exists. [Quick Assist](https://attack.mitre.org/software/S1209) allows for remote screen sharing and, with end user …

    Published 14/03/2025 20:13 · Modified 27/03/2026 01:07
  • BITSAdmin uses
    The MITRE Corporation Confidence 100

    [BITSAdmin](https://attack.mitre.org/software/S0190) is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/T1197). (Citation: Microsoft BITSAdmin)

    Published 18/04/2018 19:59 · Modified 27/03/2026 01:07
  • Impacket uses
    The MITRE Corporation Confidence 100

    [Impacket](https://attack.mitre.org/software/S0357) is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. [Impacket](https://attack.mitre.org/software/S0357) contains several tools for remote service execution, Kerberos manipulation, …

    Published 31/01/2019 02:39 · Modified 27/03/2026 01:07
  • PsExec uses
    The MITRE Corporation Confidence 100

    [PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.(Citation: Russinovich Sysinternals)(Citation: SANS …

    Published 31/05/2017 23:32 · Modified 27/03/2026 01:07