Blitz Brigantine
Blitz Brigantine, also tracked as Storm-1811 and STAC5777, is a financially motivated threat cluster linked to Black Basta and Cactus ransomware operations. Reporting in the provided content describes it as a ransomware affiliate and notes Microsoft has linked Storm-1811 to Black Basta activity. The group has targeted finance and healthcare organizations, including victims across the United States, United Kingdom, Germany, Canada, Australia, France, Japan, South Korea, Singapore, and Switzerland. The group is described as using social engineering for initial access, notably email bombing followed by Microsoft Teams messages or vishing while impersonating internal IT or help desk staff. Victims are persuaded to launch Windows Quick Assist, giving the operators remote access. After access is obtained, the actors deploy trojanized MSI installers masquerading as Microsoft software such as Teams-related updates or Cross Device Add-in packages, sometimes hosted on personal Microsoft cloud storage. The installers drop legitimate Microsoft binaries together with malicious DLLs and abuse DLL sideloading, including replacement of hostfxr.dll and in some cases clipsp.dll. The malicious DLL acts as a loader for A0Backdoor, a memory-resident backdoor used for host fingerprinting, information theft, persistence, reconnaissance, and follow-on intrusion activity that can precede ransomware deployment. Reported anti-analysis features include QEMU and sandbox checks, IsDebuggerPresent checks, heavy junk thread creation, runtime-only decryption, and a roughly 55-hour execution window tied to payload decryption. The malware has also been reported to require a hidden trailing space character in a command line prompt to derive the correct decryption key. A0Backdoor uses covert DNS tunneling for command and control, including MX-style DNS queries sent through trusted public resolvers such as 1.1.1.1 and 8.8.8.8, with encoded victim metadata and command data embedded in DNS labels and responses. One reported C2 domain was fsdgh[.]com. The content describes this activity as an evolution from older ransomware-focused tradecraft toward more customized and stealth-focused intrusions.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financial Services
- Health Care Equipment & Services
Tradecraft
25 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
14 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware affiliate activity using the A0Backdoor family as a precursor for intrusion, persistence, reconnaissance, lateral movement, and eventual Black Basta or Cactus ransomware deployment. The campaign uses Teams vishing, Quick Assist abuse, trojanized MSI installers, DLL sideloading, and DNS MX tunneling for covert C2.
Social-engineering-led initial access (Microsoft Teams impersonation / fake internal IT support) followed by deployment of malicious MSI installers and DLL sideloading to load a multi-stage payload culminating in A0Backdoor; historically linked in the article to follow-on ransomware operations.
Conducting social-engineering intrusions against finance and healthcare employees by impersonating internal IT support, using email bombing and Microsoft Teams to obtain Quick Assist remote access, then deploying a stealthy loader and A0Backdoor for persistence and information theft.
Financially motivated intrusion cluster using Microsoft Teams impersonation and Windows Quick Assist social engineering to gain remote access, then deploying signed MSI-based loaders/backdoors and (in prior documented chains) follow-on tooling leading to ransomware deployment.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.