Blitz Brigantine Weaponizes Email Bombing and DNS MX Records to Deploy AOBackdoor

BlueVoyant describes a sophisticated Blitz Brigantine (Storm-1811) campaign linked to Black Basta affiliates that uses email-bombing and social-engineering via Microsoft Teams Quick Assist to gain remote access, deploy malicious MSI installers that sideload a DLL, and deliver a final AOBackdoor which uses DNS MX-record tunneling to hide C2 traffic; the malware includes anti-analysis and time-gating protections and has targeted finance and healthcare since at least August 2025.