Storm-1811

Storm-1811 is a financially motivated cybercriminal group tracked by Microsoft. The provided content states that Microsoft has linked Storm-1811 to Black Basta ransomware deployment and observed it abusing Microsoft Teams and Quick Assist in 2024 to impersonate IT support personnel and socially engineer victims into granting remote access. Known aliases in the content are Curly Spider and Storm-1811. Reported tradecraft in the provided content includes registering Microsoft 365 tenants with generic support-themed display names such as "Help Desk," "Help Desk IT," "Help Desk Support," and "IT Support"; contacting targets over Microsoft Teams; prompting users to execute downloaded software and payloads through social engineering; and using Quick Assist for remote access. Additional behaviors directly mentioned include use of multiple batch scripts during initial access and follow-on activity, creation of Windows Registry Run keys to execute batch scripts for persistence, local staging of captured credentials for later manual exfiltration, use of whoami.exe to determine whether the active user has administrator privileges, acquisition of legitimate and malicious tooling including remote monitoring and management software and commodity malware packages, distribution of password-protected ZIP archives, and use of SSH-related activity mapped to ATT&CK T1021.004. The content also states that Storm-1811 disguised Cobalt Strike installers as a malicious DLL masquerading as part of a legitimate 7-Zip installation package, and XOR-encoded a Cobalt Strike installation payload in a DLL that was decoded with a hardcoded key when invoked by a legitimate 7-Zip installation process. Public reporting cited in the content says Storm-1811 activity timing aligned with 3AM ransomware activity. The content does not provide a nation-state attribution.