A0Backdoor via Microsoft Teams Social Engineering — Storm-1811/STAC5777 DNS MX C2 Covert Channel — Threadlinqs Intelligence
As of 2026-05-30, A0Backdoor via Microsoft Teams Social Engineering — Storm-1811/STAC5777 DNS MX C2 Covert Channel is a high-severity ransomware threat attributed to Storm-1811 (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0243 · Severity: HIGH · Status: MONITORING · Category: RANSOMWARE
Attribution: Storm-1811 · Russia · FINANCIAL
Storm-1811 (STAC5777/Blitz Brigantine) deploys A0Backdoor malware via Microsoft Teams IT support impersonation and Quick Assist abuse. The backdoor uses a novel DNS MX record covert channel for C2
Storm-1811, also tracked as STAC5777 and Blitz Brigantine, is a financially motivated threat group affiliated with Black Basta ransomware-as-a-service operations. Since August 2025, the group has deployed a newly identified backdoor dubbed A0Backdoor through an increasingly refined social engineering attack chain targeting professionals in the finance and healthcare sectors.
The attack begins with an email bombing phase that floods the victim's inbox with up to 3,000 non-malicious spam messages within an hour. The threat actors then contact the victim via Microsoft Teams, impersonating internal IT support staff using tenant names such as 'Help Desk', 'Help Desk IT', 'Help Desk Support', and 'IT Support'. Display names may use homoglyphs and Unicode character substitution to bypass keyword-based filters. The actors walk the victim through installing or launching Microsoft Quick Assist, granting the adversary remote control of the device.
Once remote access is established, the operators deploy digitally signed MSI installers (Update.msi, UpdateFX.msi, or packages masquerading as Microsoft Teams Phone Link and Cross Device Add-in) hosted on personal Microsoft OneDrive cloud storage accounts via tokenized links. These MSIs contain a legitimate Windows binary, CrossDeviceService.exe, bundled with a malicious replacement of hostfxr.dll — a normally Microsoft-signed .NET host framework resolver library. The malicious hostfxr.dll is signed with a certificate issued to MULTIMEDIOS CORDILLERANOS SRL, a non-Microsoft entity.
When CrossDeviceService.exe loads the sideloaded hostfxr.dll, the malicious DLL executes embedded shellcode. The shellcode performs anti-analysis checks including sandbox detection and timing-based evasion, and spawns excessive threads via the CreateThread API to crash debuggers. It then derives an AES decryption key using SHA-256 hashing, with part of the key derived from the ASCII string 'crossdeviceservice.exe' and a trailing non-breaking space character appended to the command line. The AES-decrypted payload is the A0Backdoor, which operates entirely in memory without writing traditional file artifacts to disk.
A0Backdoor's most notable capability is its DNS MX record covert C2 channel. Rather than using HTTP/HTTPS or raw TCP callbacks, the malware crafts DNS MX queries with high-entropy, per-request subdomains that encode beacon metadata including host identifiers and counters. These queries are sent exclusively to trusted public recursive resolvers (1.1.1.1 and 8.8.8.8), ensuring traffic blends with legitimate DNS resolution. The attacker-controlled authoritative DNS server responds with MX records where the 'exchange' hostname's leftmost label encodes command/configuration data using a domain-safe alphanumeric alphabet. DNS resolvers enforce hostname syntax but do not validate that the exchange points to a working mail server, allowing this covert channel to function transparently through enterprise DNS infrastructure.
The A0Backdoor performs system enumeration using Windows APIs including DeviceIoControl, GetUserNameExW, and GetComputerNameW to fingerprint the compromised host. Post-compromise activity consistent with Storm-1811 operations includes credential harvesting, domain enumeration, lateral movement via SMB/Windows Admin Shares and RDP, deployment of additional tools (historically Cobalt Strike, ScreenConnect, NetSupport Manager), and ultimately Black Basta ransomware deployment.
BlueVoyant researchers identified at least two confirmed victims in Canada's financial sector. The broader campaign spans 10 countries: United States, United Kingdom, Germany, Canada, Australia, France, Japan, South Korea, Singapore, and Switzerland. While the A0Backdoor and DNS MX C2 represent new capabilities, the social engineering playbook is a direct evolution of Storm-1811's documented tactics dating back to May 2024.
Weaknesses (CWE)
CWE-426, CWE-494
Target sectors: financial-services, healthcare, insurance, banking, pharmaceutical
Target regions: North America, Europe, Asia-Pacific, United States, United Kingdom, Germany, Canada, Australia, France, Japan, South Korea, Singapore
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RANSOMWARE, HIGH, threat intelligence, cybersecurity, T1667, T1656, T1566, T1204, T1059, T1547, T1574, T1036, T1027, T1140