rapid7-email-bombing

Storm-1811 has attempted to move laterally in victim environments via SMB using Impacket.

Storm-1811 XOR encodes a Cobalt Strike installation payload in a DLL file that is decoded with a hardcoded key when called by a legitimate 7zip installation process.

Storm-1811 has used `whoami.exe` to determine if the active user on a compromised system is an administrator.

Storm-1811 has prompted users to download and execute batch scripts that masquerade as legitimate update files during initial access and social engineering operations.

Storm-1811 has disguised Cobalt Strike installers as a malicious DLL masquerading as part of a legitimate 7zip installation package.

Storm-1811 has exfiltrated captured user credentials via Secure Copy Protocol (SCP).

Storm-1811 has used a PowerShell script to capture user credentials after prompting a user to authenticate to run a malicious script masquerading as a legitimate update item.

Storm-1811 has used PowerShell for multiple purposes, such as using PowerShell scripts executing in an infinite loop to create an SSH connection to a command and control server.

Storm-1811 has used multiple batch scripts during initial access and subsequent actions on victim machines.

Storm-1811 has locally staged captured credentials for subsequent manual exfiltration.

Storm-1811 has used scripted `cURL` commands, BITSAdmin, and other mechanisms to retrieve follow-on batch scripts and tools for execution on victim devices.

Storm-1811 has distributed password-protected archives such as ZIP files during intrusions.

Storm-1811 has prompted users to execute downloaded software and payloads as the result of social engineering activity.

Storm-1811 has abused multiple types of legitimate remote access software and tools, such as ScreenConnect, NetSupport Manager, and AnyDesk.

Storm-1811 has used `cacls.exe` via batch script to modify file and directory permissions in victim environments.

Storm-1811 has created Windows Registry Run keys that execute various batch scripts to establish persistence on victim devices.

Storm-1811 has initiated voice calls with victims posing as IT support to prompt users to download and execute scripts and other tools for initial access.

Storm-1811 has used the Impacket toolset to move and remotely execute payloads to other hosts in victim networks.

Storm-1811 has deployed a malicious DLL (7z.DLL) that is sideloaded by a modified, legitimate installer (7zG.exe) when that installer is executed with an additional command line parameter of `b` at runtime to load a Cobalt Strike beacon payload.

Storm-1811 has created domains for use with RMM tools.

Storm-1811 acquired various legitimate and malicious tools, such as RMM software and commodity malware packages, for operations.

Storm-1811 has deployed large volumes of non-malicious email spam to victims in order to prompt follow-on interactions with the threat actor posing as IT support or helpdesk to resolve the problem.