Threat actor · all actors
Storm-1811G1046 unknown
aka Storm-1811, UNC4393, CURLY SPIDER, STAC5777, Cardinal
Last updated: 2026-08-20
About this actor
[Storm-1811](https://attack.mitre.org/groups/G1046) is a financially-motivated entity linked to [Black Basta](https://attack.mitre.org/software/S1070) ransomware deployment. [Storm-1811](https://attack.mitre.org/groups/G1046) is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.(Citation: Microsoft Storm-1811 2024)(Citation: rapid7-email-bombing)(Citation: RedCanary Storm-1811 2024)(Citation: RedCanary June Insights 2024)
Source: MITRE ATT&CK
Names & naming systems
Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.
MITRE ATT&CKG-number catalogue id
Microsoftweather-system names
CrowdStrikenation-animal names
MandiantUNC uncategorised cluster
Unclassifiedno scheme matched
How we know this
- Data origin
- MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
- Techniques
- MITRE ATT&CK STIX mappings — 47 ATT&CK techniques on file.
- Named victims
- None on file.
See how actor data is built for the full pipeline.
Activity timeline
No activity events recorded.
Profile
| CVE | Risk | CVSS | EPSS | Published | Products |
|---|---|---|---|---|---|
| No attributed CVEs. | |||||
T1021Remote Services ↗T1021.002SMB/Windows Admin Shares ↗T1021.004SSH ↗T1027Obfuscated Files or Information ↗T1027.013Encrypted/Encoded File ↗T1033System Owner/User Discovery ↗T1036Masquerading ↗T1036.005Match Legitimate Resource Name or Location ↗T1036.010Masquerade Account Name ↗T1048Exfiltration Over Alternative Protocol ↗T1048.002Exfiltration Over Asymmetric Encrypted Non-C2 Protocol ↗T1056Input Capture ↗T1059Command and Scripting Interpreter ↗T1059.001PowerShell ↗T1059.003Windows Command Shell ↗T1074Data Staged ↗T1074.001Local Data Staging ↗T1087Account Discovery ↗T1087.002Domain Account ↗T1105Ingress Tool Transfer ↗T1140Deobfuscate/Decode Files or Information ↗T1204User Execution ↗T1204.002Malicious File ↗T1219Remote Access Tools ↗T1219.002Remote Desktop Software ↗T1222File and Directory Permissions Modification ↗T1222.001Windows Permissions ↗T1482Domain Trust Discovery ↗T1486Data Encrypted for Impact ↗T1547Boot or Logon Autostart Execution ↗T1547.001Registry Run Keys / Startup Folder ↗T1566Phishing ↗T1566.002Spearphishing Link ↗T1566.003Spearphishing via Service ↗T1566.004Spearphishing Voice ↗T1570Lateral Tool Transfer ↗T1574Hijack Execution Flow ↗T1574.001DLL ↗T1583Acquire Infrastructure ↗T1583.001Domains ↗T1585Establish Accounts ↗T1585.003Cloud Accounts ↗T1588Obtain Capabilities ↗T1588.002Tool ↗T1667Email Bombing ↗T1684Social Engineering ↗T1684.001Impersonation ↗
Mitigating controls (NIST 800-53)
| Control | Techniques covered | Coverage |
|---|---|---|
SI-4 | 27 / 47 | 57% |
CM-6 | 26 / 47 | 55% |
CM-2 | 22 / 47 | 47% |
SI-3 | 20 / 47 | 43% |
AC-3 | 18 / 47 | 38% |
CM-7 | 18 / 47 | 38% |
CA-7 | 17 / 47 | 36% |
AC-2 | 16 / 47 | 34% |
AC-6 | 15 / 47 | 32% |
SI-10 | 14 / 47 | 30% |
SI-7 | 14 / 47 | 30% |
AC-4 | 13 / 47 | 28% |
SC-7 | 12 / 47 | 26% |
IA-2 | 9 / 47 | 19% |
AC-5 | 8 / 47 | 17% |
Co-occurring actors
None.
Similar actors
Similar TTPs
- WIRTE 0.33
- menuPass 0.29
- MirrorFace 0.27
- MuddyWater 0.26
- Sidewinder 0.25