Actor Profile

Storm-1175 is a financially motivated threat actor believed to be based in China, previously affiliated with the Medusa ransomware operation. Microsoft Threat Intelligence tracks this actor as a former Medusa affiliate who has now shifted to deploying a new ransomware variant called StormEncryptor. The actor is characterized by rapid attack cycles, moving from initial access to data exfiltration and ransomware deployment within days. Storm-1175 has historically exploited zero-day and n-day vulnerabilities in enterprise software to gain initial access to target networks.

TTPs (Tactics, Techniques, Procedures)

Initial access is achieved through exploitation of authentication-bypass vulnerabilities, specifically CVE-2026-18577 in N-central RMM tool (T1190: Exploit Public-Facing Application). Post-compromise, the actor deploys remote access tools including AnyDesk and SimpleHelp for persistence and remote management (T1219: Remote Access Software). Network discovery is conducted using Advanced IP Scanner (T1046: Network Service Discovery). Credential dumping is performed using Mimikatz to extract credentials from LSASS (T1003.001: LSASS Memory). Data exfiltration precedes ransomware deployment (T1486: Data Encrypted for Impact). StormEncryptor is a C++ ransomware that appends ".encrypted" extensions and drops ransom notes named '!!!README_FIRST!!!.txt' with a three-day payment deadline and data leak threats (T1486, T1491: Defacement).

Targets & Patterns

Storm-1175 targets organizations using vulnerable enterprise software and remote management tools. Historical targeting includes organizations running GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Ivanti Connect Secure, and JetBrains TeamCity. The current campaign targets organizations using self-hosted N-central RMM servers. The actor's motivation is financial gain through double extortion ransomware tactics—encrypting systems and threatening to leak stolen data if ransom demands are not met within three days. The rapid attack tempo (initial access to encryption within days) suggests targeting of opportunity based on vulnerability disclosure rather than sector-specific selection.

Historical Context

Storm-1175 was previously linked to the Medusa ransomware operation, leveraging zero-day and n-day vulnerabilities in multiple enterprise products including GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Ivanti Connect Secure, and JetBrains TeamCity. The deployment of StormEncryptor marks the actor's first observed activity since April 2026 and represents a strategic shift away from Medusa ransomware. This transition suggests either a split from the Medusa affiliate program or a tactical evolution to evade detection signatures associated with Medusa. The move to a new ransomware variant while maintaining consistent TTPs (rapid exploitation, credential dumping, double extortion) indicates operational continuity despite the malware change.

Defensive Recommendations

  • Immediately apply N-able hotfix 2026.3 HF1 (build 2026.3.1.7) to address CVE-2026-18577 authentication bypass vulnerability in self-hosted N-central servers
  • Monitor for indicators of compromise including svchost.exe files in user Documents folders, registered services named 'Cloudflared', and suspicious inbound connections from known malicious IPs listed in N-able advisory
  • Detect credential dumping via T1003.001 by monitoring for unauthorized access to LSASS process memory, particularly Mimikatz execution patterns through EDR telemetry and Sysmon Event ID 10 (ProcessAccess)
  • Block or heavily restrict remote access tools like AnyDesk and SimpleHelp (T1219) through application control policies, and alert on unauthorized RMM tool installations
  • Implement network segmentation and monitor for Advanced IP Scanner or similar network discovery tools (T1046) via network traffic analysis and endpoint detection to identify lateral movement attempts during the rapid attack window