Skip to content

Storm-1811

IntrusionSet · ATTACK:enterprise:G1046

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1046",
  "title": "Storm-1811",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1046",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--319fd652-edde-46b2-9987-3519493989f5",
  "external_id": "G1046",
  "domain": "enterprise",
  "created": "2025-03-14T12:48:44.771Z",
  "modified": "2026-07-31T18:47:47.257Z",
  "version": "1.0",
  "aliases": [
    "Storm-1811"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Microsoft Storm-1811 2024",
      "url": "https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"
    },
    {
      "source_name": "RedCanary Storm-1811 2024",
      "url": "https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/"
    },
    {
      "source_name": "RedCanary June Insights 2024",
      "url": "https://redcanary.com/blog/threat-intelligence/intelligence-insights-june-2024/"
    },
    {
      "source_name": "rapid7-email-bombing",
      "url": "https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"
    }
  ]
}

Explicit source assertions (38)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S1070

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--035faa39-bed9-4aed-bbc4-80c7a653f046

Microsoft Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1585.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--055e53e9-1f00-47fe-906f-526b6ed6de30

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--05669b75-65ea-4b30-8f97-f2c806a0703d

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1667

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0596eecc-c6cd-4ec4-ac7a-9b0648e1a10f

RedCanary Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f1d0255-d27c-40d6-9c01-b2c9e9331f93

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a212fc1-1c0e-4f48-9dac-f1439defc9d6

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a79e7df-12a8-41c3-990b-158c31ce9666

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b5ece1f-a678-40af-b4e3-1787ae3de343

Microsoft Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cb496c7-81ed-423b-8564-8db1c8a2078f

Microsoft Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S1209

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fd9a7e9-fbbe-48c1-af49-09a86d21bfc7

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1219.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3396c5b4-3f52-498d-9dfd-812fb0acd543

Microsoft Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3aee51e9-9dad-44da-ad48-b2ca7afdeefd

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S0190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b6996b8-7890-466b-9435-45ecff42f82f

Microsoft Storm-1811 2024 · RedCanary June Insights 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45cdd56e-56a0-4d76-8594-37b2836c0612

Microsoft Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5158f210-229d-438e-ae98-cc118ee6c371

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--568ad9ef-8cbc-4274-b99e-a33c455096cb

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1036.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5787c224-146a-47a5-ae68-d9603d1545f2

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1056

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58c773e3-a31b-4562-83a5-815cf958b6be

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a63e7cf-1914-4f05-ac85-5aa1690ed3ef

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6a43c789-142f-4c88-bac3-e3c065441d98

Microsoft Storm-1811 2024 · RedCanary Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7a5d3c81-084a-413f-b696-8d7753a40e14

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1566.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e7ac48f-8e12-4e44-8187-4cf4a3b515d2

Microsoft Storm-1811 2024 · RedCanary Storm-1811 2024 · rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S0650

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80800c66-bf13-4dc4-875e-04db77a12def

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81fe021e-6502-4a27-9f4d-59d0bb9efbe6

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1684.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b3cbcdd-bbe0-4e98-bef6-c81b1549f625

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f025145-ed37-4a29-bf4c-2fb3aa42e1f1

Microsoft Storm-1811 2024 · RedCanary June Insights 2024 · rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9626a92f-a0f1-4bf1-9802-405bb6d46ccb

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97b7c8f4-d3b2-4992-8801-c62c68a17eca

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a33939b9-83e7-435a-bfc5-1889d720b7ec

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b771894c-366a-4e73-af67-d6d43d2c9881

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1482

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c99726c4-6778-4586-88a7-4e64917dbf74

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1566.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ceffc6ab-75ce-4efa-97f7-c1cd9a82385a

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2d8fc99-7aaf-41c3-98e0-0ceae6ff48ad

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d317032f-75dc-4d73-95ec-eabf3ed9d947

Microsoft Storm-1811 2024

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ef8e36e1-24ce-4d32-9c78-40388e1f07b9

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1048.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f290ae63-3d6e-4393-a0b4-385ea577c1e9

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1222.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f661d83b-ef6a-4825-bfd5-77138ff4700b

rapid7-email-bombing

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe16ff68-56ac-4e5f-9566-8b79125f0dcf

rapid7-email-bombing

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.