Storm-0826 is a financially motivated cybercriminal group operating within the Black Basta ransomware ecosystem.
Storm-0826 is a financially motivated cybercriminal group operating as an affiliate within the Black Basta ransomware-as-a-service (RaaS) ecosystem. The group primarily obtains initial access through handoffs from Storm-0464, a known distributor of the Qakbot malware. Its main TTP involves deploying Black Basta ransomware using externally provided access. Defenders should prioritize robust detection for Qakbot infections and enhance network segmentation and endpoint visibility to block the transition to ransomware operations.
Storm-0826 is a financially motivated cybercriminal group operating as an affiliate within the Black Basta ransomware-as-a-service (RaaS) ecosystem. This actor's primary known method of obtaining initial access is through handoffs from Storm-0464, a known distributor of the Qakbot malware
Storm-0826 primarily obtains initial access through handoffs from Storm-0464, a known distributor of the Qakbot malware.
Storm-0826 is a financially motivated cybercriminal group operating as an affiliate within the Black Basta ransomware-as-a-service (RaaS) ecosystem.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.