Blitz Brigantine

Storm-1811, also known as Blitz Brigantine and STAC5777, is a financially motivated intrusion cluster associated with Black Basta and Cactus ransomware operations. The actor is known for social-engineering-led initial access, particularly email bombing followed by impersonation of internal IT or help-desk personnel over Microsoft Teams, then persuading targets to launch Quick Assist to grant remote access. This tradecraft has been used against organizations in finance and healthcare and has supported follow-on malware deployment and ransomware activity. Recent activity attributed to this cluster shows a shift toward more customized and stealth-focused post-access tooling. After obtaining remote access, the operators deploy digitally signed MSI installers masquerading as legitimate Microsoft software updates. These packages place legitimate Microsoft-signed binaries alongside attacker-controlled DLLs to achieve DLL sideloading, including abuse of components such as hostfxr.dll and clipsp.dll. The loader chain uses anti-analysis and defense-evasion measures including junk thread creation, debugger checks, virtualization and sandbox detection, environmental keying, and time-windowed decryption before executing an in-memory backdoor known as A0Backdoor. A0Backdoor fingerprints compromised hosts and uses covert DNS tunneling for command and control, including MX-record-based exchanges through trusted public recursive resolvers to reduce direct endpoint contact with attacker-controlled infrastructure. Reporting also assesses the backdoor as a precursor capability for reconnaissance, persistence, lateral movement, and eventual ransomware deployment. Across observed campaigns, Storm-1811 has demonstrated strong emphasis on social engineering, signed malware delivery, DLL sideloading, stealthy command and control, and post-compromise intrusion enablement in support of financially driven extortion ecosystems.