Storm-1811 gets in by making a user's inbox unusable and then calling, or messaging on Microsoft Teams, as the help desk that will fix it, so the victim opens a remote session for the attacker. Microsoft describes Storm-1811 as a financially motivated group that deploys Black Basta ransomware, and its playbook of email bombing, help desk impersonation and abuse of Quick Assist has since been copied widely. This profile covers the group's names, targeting, the ATT&CK techniques recorded against it, how it captures credentials and sessions, and the specific Teams, Windows and identity controls that break the chain. It is for SOC analysts, Microsoft 365 administrators, help desk managers and identity teams. For the wider pattern of phone-led lures, see the Callback Phishing (TOAD) Guide.
Key takeaways
- The lure is a support problem the attacker created: victims are signed up to large numbers of newsletters and subscription services, then contacted by "IT support" offering to stop the flood.
- Legitimate tools do the hard work: Quick Assist, AnyDesk, ScreenConnect and NetSupport Manager give the attacker interactive control without an exploit.
- Teams external chat is a delivery channel: attacker-created tenants send chats and calls with display names such as "Help Desk", and Teams allows all external domains by default.
- Credentials are harvested in the session: fake "spam filter update" scripts prompt for passwords, and EvilProxy adversary-in-the-middle pages capture passwords and session tokens.
- Most of the fix is configuration: remove or block Quick Assist, allowlist remote tools, restrict Teams external access, require phishing-resistant MFA and give users one known way to reach the real help desk.
Who they are (names and aliases)
Storm-1811 is a Microsoft name. The Storm- prefix marks a cluster Microsoft is still developing, so the name may change if Microsoft gains more confidence in the operators' identity. MITRE ATT&CK tracks the group as G1046 and, in v20, records no other associated group names. Microsoft first observed the activity in mid-April 2024 and published its analysis on 15 May 2024, with a June 2024 update adding the Teams vector seen at the end of May 2024. Rapid7 independently reported the same pattern on 10 May 2024, first seen in late April 2024, and linked its indicators to Black Basta operators. See the Threat Actor Naming Conventions Guide for how temporary names work.
| Item | Detail | Source |
|---|---|---|
| Primary name | Storm-1811 | Microsoft Threat Intelligence |
| ATT&CK ID | G1046 (no associated groups recorded in v20) | MITRE ATT&CK |
| Motive | Financial, ransomware deployment | Microsoft |
| Linked ransomware | Black Basta (ATT&CK S1070) | Microsoft; Rapid7 |
| First observed | Mid-April 2024 | Microsoft |
Copycat activity is common. Other clusters now use the same email bombing and help desk script, so finding this pattern in your logs does not by itself mean Storm-1811. Track the technique chain as well as the name.
Targeting and motivation
The goal is ransomware revenue. Microsoft explains that Black Basta is a closed ransomware operation that typically relies on other groups, such as Qakbot distributors, for initial access; Storm-1811 sits in that access role and also carries intrusions through to deployment. Targeting is opportunistic rather than sector-specific: any organisation where staff will accept a call or chat from "IT" and where a remote support tool is available is suitable.
- Who gets called: ordinary employees whose inboxes have just been flooded, often several in the same organisation.
- What makes a victim attractive: Microsoft 365 tenants that accept Teams chats from any external domain, Windows endpoints with Quick Assist installed, users without phishing-resistant MFA, and a help desk that users cannot easily verify.
- What happens next: Microsoft observed domain enumeration, lateral movement and Black Basta deployment with PsExec. Rapid7 did not see ransomware in its own cases, but saw credential theft and attempted Cobalt Strike deployment.
Tactics and techniques (MITRE ATT&CK)
All techniques below are recorded against Storm-1811 (G1046) in ATT&CK v20. They are listed in the order an intrusion usually runs.
| Stage | Technique | What the group does |
|---|---|---|
| Resource development | T1585.003 Cloud Accounts; T1583.001 Domains | Creates Microsoft 365 tenants and Teams accounts spoofing IT support; registers domains for RMM tools |
| Initial access (pretext) | T1667 Email Bombing | Large volumes of non-malicious subscription mail to create a problem to "fix" |
| Initial access | T1566.004 Spearphishing Voice; T1566.003 Spearphishing via Service | Phone calls and Teams messages and calls posing as help desk |
| Impersonation | T1684.001 Impersonation; T1036.010 Masquerade Account Name | Display names such as "Help Desk" or "IT Support" on attacker-owned Teams accounts |
| Command and control | T1219.002 Remote Desktop Software | Quick Assist, AnyDesk, ScreenConnect, NetSupport Manager |
| Execution | T1204.002 Malicious File; T1059.003 Windows Command Shell; T1059.001 PowerShell | Batch scripts presented as spam filter updates; PowerShell loops for SSH reverse shells |
| Credential access | T1056 Input Capture; T1566.002 Spearphishing Link | Script prompts for credentials; redirection to EvilProxy phishing pages |
| Persistence and tunnelling | T1547.001 Registry Run Keys; T1021.004 SSH | Run keys launching scripts; OpenSSH tunnels with attacker RSA keys |
| Defence evasion | T1574.001 DLL; T1036.005 Match Legitimate Resource Name or Location | Cobalt Strike as 7z.DLL side-loaded by 7zG.exe; renamed OpenSSH binary |
| Discovery and lateral movement | T1087.002 Domain Account; T1482 Domain Trust Discovery; T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer | Domain enumeration, Impacket over SMB, PsExec |
| Exfiltration and impact | T1048.002 Exfiltration Over Asymmetric Encrypted Non-C2 Protocol; T1486 Data Encrypted for Impact | Captured credentials sent by SCP; Black Basta encryption |
Software recorded for the group in ATT&CK includes Quick Assist (S1209), QakBot, Cobalt Strike, Impacket, PsExec, BITSAdmin and Black Basta. Microsoft also reports SystemBC used as a proxy.
How they abuse identities and credentials
Storm-1811 needs a user's trust first and that user's credentials second. The identity weaknesses it relies on are specific and fixable.
- Help desk identity is unverifiable: users have no reliable way to tell a real IT caller from a fake one. A Teams display name of "Help Desk" from a new external tenant looks official unless the user notices the External tag. See the Account Recovery and Help Desk Security Guide.
- Passwords typed into scripts: Rapid7 describes a script that prompted the user to log in under a false "update" pretext and sent the credentials to the attacker by SCP. Those are domain credentials reused for lateral movement.
- Sessions stolen by adversary-in-the-middle: Microsoft reports redirection to EvilProxy sites that capture passwords and session tokens. Push or OTP MFA does not stop this; FIDO2 and Windows Hello for Business resist it. See the Phishing-Resistant MFA Guide.
- Remote sessions as an identity: a Quick Assist session gives the attacker the signed-in user's context, including access tokens cached on the device, without any authentication by the attacker.
- Attacker SSH keys as machine credentials: the OpenSSH tunnel uses RSA keys the attacker drops, creating a persistent, key-based identity on the host that survives password resets.
- Tenant trust: the attacker's own Microsoft 365 tenant is a legitimate cloud identity. Federation settings decide whether it can reach your users.
Notable incidents
Public reporting on Storm-1811 describes campaigns rather than named victims.
| Date | Report | Key points |
|---|---|---|
| Late April 2024 | Rapid7 incident response | Email floods, calls from fake IT, AnyDesk or Quick Assist in every case observed, credential harvesting script, OpenSSH persistence |
| Mid-April to May 2024 | Microsoft Threat Intelligence | Quick Assist sessions leading to Qakbot, Cobalt Strike, ScreenConnect, NetSupport and Black Basta deployment |
| End of May 2024 | Microsoft update | Teams messages from attacker tenants with help desk display names; EvilProxy credential phishing |
The same help desk pretext appears in other clusters. In the Storm-2949 Azure attack, a different Microsoft-tracked actor posed as IT support, persuaded users to approve MFA prompts after triggering self-service password reset, and went on to read Key Vault secrets. Controls that verify the help desk defend against both.
Detection and defence
Hardening controls
| Attack step | Control | Specific setting or action |
|---|---|---|
| Email bombing | Detect and triage floods | Alert on per-recipient spikes in inbound bulk or newsletter mail; tell users a flood is a warning sign of a follow-up call |
| Teams contact | Restrict external access | Teams admin center, Users, External access: change from the default "Allow all external domains" to "Allow only specific external domains" (Set-CsTenantFederationConfiguration -AllowedDomains); review -AllowTeamsConsumer and -AllowTeamsConsumerInbound for unmanaged accounts |
| Quick Assist | Remove or block | Get-AppxPackage -Name MicrosoftCorporationII.QuickAssist | Remove-AppxPackage -AllUsers, or block remoteassistance.support.services.microsoft.com (this also breaks Intune Remote Help) |
| Other RMM tools | Allowlist | Baseline approved tools; block others with App Control for Business (WDAC) or AppLocker and block their domains. See the RMM Tool Security Guide |
| Credential capture | Phishing-resistant MFA | Conditional Access authentication strength requiring phishing-resistant methods for employees and external users on critical apps |
| Payload execution | Attack surface reduction | ASR rules blocking executables that do not meet prevalence, age or trusted list criteria, obfuscated scripts and process creation from PsExec and WMI; tamper protection on |
| Help desk verification | Process | Publish one internal channel for IT contact; IT never initiates remote sessions through unsolicited calls or external chats |
Microsoft notes that Quick Assist creates no logs on either device, so removal is more effective than trying to monitor it. Organisations that need supported remote help within one tenant can use Intune Remote Help, which adds Conditional Access, role-based access and session logging.
What to monitor
- Mail: sudden spikes in inbound mail to one or a few users, especially subscription confirmations.
- Teams: first-contact chats and calls from external tenants, particularly display names containing "help", "IT", "support" or "service desk". Microsoft publishes advanced hunting queries for both mail anomalies and foreign-tenant help desk chats.
- Endpoints: quickassist.exe launching shortly after an external Teams call; curl.exe or bitsadmin.exe downloading batch or ZIP files to user folders; new HKCU Run keys; ssh.exe or renamed OpenSSH binaries making outbound connections; 7zG.exe loading a DLL from a user directory; the Defender for Endpoint alert "Suspicious activity using Quick Assist".
- Identity: sign-ins from new locations shortly after a remote session, token replay from unfamiliar infrastructure, and new MFA method registrations.
- Lateral movement: PsExec service creation (System event ID 7045) and Impacket-style SMB execution across many hosts.
Metrics
- Percentage of Windows endpoints without Quick Assist, or with it blocked (target 100 percent where Remote Help or another approved tool exists).
- Number of unapproved remote access tools executed per month, trending to zero.
- Whether Teams external access is restricted to an allowlist, and the number of allowlisted domains reviewed each quarter.
- Percentage of users on phishing-resistant MFA.
- Percentage of staff who report a simulated help desk call or chat, and median time from email flood alert to user contact by the real SOC.
Rollout order
- Inventory remote support tools in use and agree the single approved tool with IT support.
- Remove Quick Assist from a pilot ring, confirm the help desk can still support users, then expand. Roll back by reinstalling from the Microsoft Store if a dependency appears.
- Move Teams external access to an allowlist: collect partner domains from chat logs for 30 days, add them, then switch. Keep a fast process for adding new partners.
- Deploy application control for RMM tools in audit mode, review events for two weeks, then enforce.
- Enforce phishing-resistant MFA through Conditional Access, starting with administrators and finance.
- Brief staff and the help desk: floods are a warning sign, IT will never ask for a remote session through an unsolicited call or external chat, and here is how to report one. Run a simulated call to test it.
Practitioner checklist
- Remove or block Quick Assist where it is not the approved support tool.
- Allowlist approved remote access software and block the rest by executable and domain.
- Restrict Teams external access to known domains and review unmanaged Teams account settings.
- Require phishing-resistant MFA through Conditional Access authentication strength.
- Enable ASR rules for low-prevalence executables, obfuscated scripts and PsExec or WMI process creation.
- Alert on inbound email floods and contact the affected user before an attacker does.
- Hunt for external help desk chats, Quick Assist launches and curl or BITSAdmin downloads after calls.
- After a suspected session, revoke the user's sessions and tokens, reset the password, remove unknown SSH keys and Run keys, and check for new MFA methods.
Standards and references
- MITRE ATT&CK: Storm-1811 (G1046)
- Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks leading to ransomware
- Rapid7: Ongoing social engineering campaign linked to Black Basta ransomware operators
- Microsoft Learn: Use Quick Assist to help users
- Microsoft Learn: Manage external meetings and chat with people and organisations using Microsoft identities
- MITRE ATT&CK: Email Bombing (T1667)
- MITRE ATT&CK: Quick Assist (S1209)
Related NHI Mgmt Group resources: Black Basta Threat Actor Profile · Callback Phishing (TOAD) Guide · Vishing and Smishing Guide · RMM Tool Security Guide · Conditional Access Guide