Storm-1811

Techniques (MITRE ATT&CK)31

SourceMITRE ATT&CK

Vexday analysis

Storm-1811 é um agente de ameaça com motivação financeira associado à implantação do ransomware Black Basta, rastreado pelo MITRE ATT&CK sob o identificador G1046 com 31 técnicas documentadas. O grupo se destaca pelo uso de mecanismos incomuns de phishing e engenharia social para obter acesso inicial, como a sobrecarga deliberada das caixas de entrada das vítimas com spam não malicioso em grande volume, criando o pretexto para uma interação fraudulenta com um suposto "help desk" que leva à implantação de ferramentas e capacidades do adversário.

Techniques (MITRE ATT&CK) 31

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Domains Cloud Accounts Tool

Initial access

Spearphishing Link Spearphishing via Service Spearphishing Voice

Execution

PowerShell Windows Command Shell Malicious File

Persistence

Registry Run Keys / Startup Folder

Discovery

System Owner/User Discovery Domain Account Domain Trust Discovery

Lateral movement

SMB/Windows Admin Shares SSH Lateral Tool Transfer

Collection

Input Capture Local Data Staging

Command and control

Ingress Tool Transfer Remote Desktop Software

Exfiltration

Exfiltration Over Asymmetric Encrypted Non-C2 Protocol

Impact

Data Encrypted for Impact Email Bombing

defense-impairment

Windows Permissions

stealth

Encrypted/Encoded File Masquerading Match Legitimate Resource Name or Location Masquerade Account Name Deobfuscate/Decode Files or Information DLL Impersonation

Exploited vulnerabilities

No CVEs attributed to this group in public sources (MITRE ATT&CK). Absence of attribution does not mean absence of activity.

Storm-1811 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →