Procedure examples

Storm-1811 has attempted to move laterally in victim environments via SMB using Impacket.

Storm-1811 has used OpenSSH to establish an SSH tunnel to victims for persistent access.

Storm-1811 XOR encodes a Cobalt Strike installation payload in a DLL file that is decoded with a hardcoded key when called by a legitimate 7zip installation process.

Storm-1811 has used `whoami.exe` to determine if the active user on a compromised system is an administrator.

Storm-1811 has prompted users to download and execute batch scripts that masquerade as legitimate update files during initial access and social engineering operations.

Storm-1811 has disguised Cobalt Strike installers as a malicious DLL masquerading as part of a legitimate 7zip installation package.

Storm-1811 has created Microsoft Teams accounts that spoof IT support and helpdesk members for use in application and voice phishing.

Storm-1811 has exfiltrated captured user credentials via Secure Copy Protocol (SCP).

Storm-1811 has used a PowerShell script to capture user credentials after prompting a user to authenticate to run a malicious script masquerading as a legitimate update item.

Storm-1811 has used PowerShell for multiple purposes, such as using PowerShell scripts executing in an infinite loop to create an SSH connection to a command and control server.

Storm-1811 has used multiple batch scripts during initial access and subsequent actions on victim machines.

Storm-1811 has locally staged captured credentials for subsequent manual exfiltration.

Storm-1811 has performed domain account enumeration during intrusions.

Storm-1811 has used scripted `cURL` commands, BITSAdmin, and other mechanisms to retrieve follow-on batch scripts and tools for execution on victim devices.

Storm-1811 has distributed password-protected archives such as ZIP files during intrusions.

Storm-1811 has prompted users to execute downloaded software and payloads as the result of social engineering activity.

Storm-1811 has abused multiple types of legitimate remote access software and tools, such as ScreenConnect, NetSupport Manager, and AnyDesk.

Storm-1811 has used `cacls.exe` via batch script to modify file and directory permissions in victim environments.

Storm-1811 has enumerated domain accounts and access during intrusions.

Storm-1811 is a financially-motivated entity linked to the deployment of Black Basta ransomware in victim environments.

Storm-1811 has created Windows Registry Run keys that execute various batch scripts to establish persistence on victim devices.

Storm-1811 has distributed malicious links to victims that redirect to EvilProxy-based phishing sites to harvest credentials.

Storm-1811 has used Microsoft Teams to send messages and initiate voice calls to victims posing as IT support personnel.

Storm-1811 has initiated voice calls with victims posing as IT support to prompt users to download and execute scripts and other tools for initial access.

Storm-1811 has used the Impacket toolset to move and remotely execute payloads to other hosts in victim networks.

Storm-1811 has deployed a malicious DLL (7z.DLL) that is sideloaded by a modified, legitimate installer (7zG.exe) when that installer is executed with an additional command line parameter of `b` at runtime to load a Cobalt Strike beacon payload.

Storm-1811 has created domains for use with RMM tools.

Storm-1811 has created malicious accounts to enable activity via Microsoft Teams, typically spoofing various IT support and helpdesk themes.

Storm-1811 acquired various legitimate and malicious tools, such as RMM software and commodity malware packages, for operations.

Storm-1811 has deployed large volumes of non-malicious email spam to victims in order to prompt follow-on interactions with the threat actor posing as IT support or helpdesk to resolve the problem.

Storm-1811 impersonates help desk and IT support personnel for phishing and social engineering purposes during initial access to victim environments.