- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G1046 · 31 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0097 · storm-1811
What it is
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- CURLY SPIDER, WANDERING SPIDER
- Mandiant
- UNC4393
- PwC
- White Dev 115
- Secureworks
- GOLD REBELLION
- Other names
- Storm-1811 (Deprecated), Black Basta, Black_Basta, BlackBasta, Cardina, Cardinal, Curly Spider (CrowdStrike), Dark Scorpius, Lockean, STAC5777, Storm-1811 (Microsoft)
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- BITSAdmin
- BLACKCOFFEE
- Back Orifice
- Back Orifice 2000
- Batch NET
- Black Basta
- BlackEnergy
- BlackHole
- BlackNix
- Blackshades
- Cobalt Strike
- CrossRat
- Cyber Eye RAT
- CyberGate
- Impacket
- PsExec
- QakBot
- Quick Assist
- RemoteCMD
- SHIPSHAPE
Sources
- MITRE ATT&CK attack.mitre.org
- Malpedia malpedia.caad.fkie.fraunhofer.de