Storm-1811 has attempted to move laterally in victim environments via SMB using Impacket.5
group
Storm-1811 G1046
- Created
- 14 March 2025
- Last modified
- 31 July 2026
- Alias
- Storm-1811
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.[1][2][3][4]
31
Techniques68th pct
14
TacticsTop 6%
7
Tools & malware69th pct
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G1046
Storm-1811 has used OpenSSH to establish an SSH tunnel to victims for persistent access.6
Storm-1811 XOR encodes a Cobalt Strike installation payload in a DLL file that is decoded with a hardcoded key when called by a legitimate 7zip installation process.7
Storm-1811 has used whoami.exe to determine if the active user on a compromised system is an administrator.8
Storm-1811 has prompted users to download and execute batch scripts that masquerade as legitimate update files during initial access and social engineering operations.9
Storm-1811 has disguised Cobalt Strike installers as a malicious DLL masquerading as part of a legitimate 7zip installation package.10
Standing G1046
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques3168th pct
68th percentile · 68% of 176 ATT&CK groups have this many Enterprise techniques or fewer.
Tactics14Top 6%
94th percentile · 94% of 176 ATT&CK groups have this many tactics spanned or fewer.
Tools & malware769th pct
69th percentile · 69% of 176 ATT&CK groups have this many tools and malware or fewer.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique20med52nd pct
52nd percentile · 52% of 176 ATT&CK groups have this many detection rules per technique or fewer.
Tests / technique3med
Detection coverage G1046
1053 distinct rules cover the 31 techniques recorded for this group. The 1143 technique-to-rule mappings resolve to 1053 distinct rules, because one rule can cover several techniques. 766 Sigma · 287 Splunk.
23 covered by at least one rule8 with no coverage1053 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org