Microsoft Storm-1811 2024

Storm-1811 has used OpenSSH to establish an SSH tunnel to victims for persistent access.

Storm-1811 has created Microsoft Teams accounts that spoof IT support and helpdesk members for use in application and voice phishing.

Storm-1811 has used multiple batch scripts during initial access and subsequent actions on victim machines.

Storm-1811 has performed domain account enumeration during intrusions.

Storm-1811 has used scripted `cURL` commands, BITSAdmin, and other mechanisms to retrieve follow-on batch scripts and tools for execution on victim devices.

Quick Assist allows for the remote administrator to view the interactive session of the running machine, including full screen activity.

Storm-1811 has prompted users to execute downloaded software and payloads as the result of social engineering activity.

Storm-1811 has abused multiple types of legitimate remote access software and tools, such as ScreenConnect, NetSupport Manager, and AnyDesk.

Storm-1811 has enumerated domain accounts and access during intrusions.

Storm-1811 is a financially-motivated entity linked to the deployment of Black Basta ransomware in victim environments.

Storm-1811 has distributed malicious links to victims that redirect to EvilProxy-based phishing sites to harvest credentials.

Storm-1811 has used Microsoft Teams to send messages and initiate voice calls to victims posing as IT support personnel.

Storm-1811 has initiated voice calls with victims posing as IT support to prompt users to download and execute scripts and other tools for initial access.

Storm-1811 has created malicious accounts to enable activity via Microsoft Teams, typically spoofing various IT support and helpdesk themes.

Storm-1811 acquired various legitimate and malicious tools, such as RMM software and commodity malware packages, for operations.

Storm-1811 impersonates help desk and IT support personnel for phishing and social engineering purposes during initial access to victim environments.