Loading threat actor…
Storm-1811, also known as Curly Spider, is a financially motivated cybercrime threat actor active since at least 2022. Microsoft and other security researchers associate the group with ransomware operations, particularly deployment of Black Basta, and with intrusion activity using social engineering, remote-access tools, and post-compromise tradecraft. Storm-1811 commonly initiates access by email bombing targets and then impersonating help desk or IT-support personnel through telephone calls or Microsoft Teams. The operators persuade victims to authorize Microsoft Quick Assist or install legitimate remote-management tools such as AnyDesk or TeamViewer, providing interactive access to victim systems. Observed activity can progress to credential harvesting, reconnaissance, lateral movement, establishment of remote-access backdoors including SSH tunnels, and ransomware deployment. Storm-1811 has also used DLL side-loading to execute Cobalt Strike. Similar Teams- and vishing-based ransomware activity has been linked to emerging cluster UNC6692, while STAC5777 has been assessed as overlapping with Storm-1811 tradecraft. The actor’s operations rely heavily on trusted remote-support software and impersonation to evade conventional malware-focused controls.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
34 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
13 malware families attributed to this actor across reporting.
8 additional families tracked in Mallory.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
69 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.