APT GroupHigh for Microsoft’s historical Storm-1175 profile and observed tradecraft; medium for the reported likely CVE-2026-18577 initial-access link until Microsoft or N-able publishes a direct primary incident report. confidence

Storm-1175

Microsoft tracks Storm-1175 as a financially motivated, high-tempo actor that weaponizes newly disclosed vulnerabilities in internet-facing products, steals credentials, uses remote-management and tunneling tools, exfiltrates data, and historically deployed Medusa ransomware. August 10 reporting describes a new StormEncryptor ransomware family and assesses CVE-2026-18577 as the likely initial-access vector in recent intrusions. That likelihood is campaign-specific and does not attribute every N-central exploit.

Directory Briefing

Top 10 Talking Points

Storm-1175 should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.¹

The retained behavior points to Exploit Public-Facing Application; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.¹

The retained sequence includes OS Credential Dumping and Remote Services, which supports scoping beyond the initially affected host.

Identity compromise is a central scoping issue.¹

Evidence includes OS Credential Dumping; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

Persistence matters more than the first payload.¹

Retained persistence behavior includes Account Manipulation; removing malware without closing those access paths can leave the actor operational.

Legitimate administration tools may carry much of the attack.¹

Reported tooling or behavior includes Remote Services and Remote Access Software; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.¹

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.¹

The retained record includes Archive Collected Data and Exfiltration Over Web Service, making repository, email, cloud, and egress review central to impact assessment.

Victimology helps prioritize business processes, not prove attribution.¹

Retained targeting includes Healthcare, Education, Professional Services, Financial Services, and Technology across Not available; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Bottom Line Up Front

BLUF

Storm-1175 should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.¹

The retained behavior points to Exploit Public-Facing Application; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.¹

The retained sequence includes OS Credential Dumping and Remote Services, which supports scoping beyond the initially affected host.

Identity compromise is a central scoping issue.¹

Evidence includes OS Credential Dumping; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

Persistence matters more than the first payload.¹

Retained persistence behavior includes Account Manipulation; removing malware without closing those access paths can leave the actor operational.

Legitimate administration tools may carry much of the attack.¹

Reported tooling or behavior includes Remote Services and Remote Access Software; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.¹

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.¹

The retained record includes Archive Collected Data and Exfiltration Over Web Service, making repository, email, cloud, and egress review central to impact assessment.

Victimology helps prioritize business processes, not prove attribution.¹

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type¹

APT Group profile

First Seen¹

2023-01-01

Last Seen¹

2026-08-10

Origin¹

Motivation¹

Financial

Primary Access Pattern¹

T1190 Exploit Public-Facing Application

Objective¹

Financial

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases¹

Storm-1175

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure¹

Not available

Target Sectors¹

HealthcareEducationProfessional ServicesFinancial ServicesTechnologyManaged Service ProvidersSMBsComputer Systems Design and Related Services

Associated Activity¹

Rapid exploitation of newly disclosed internet-facing vulnerabilitiesUnexpected administrator creation or privileged session changesUnapproved RMM software or Cloudflare Tunnel activityMimikatz, LSASS, NTDS.dit, SAM, or Veeam credential accessMicrosoft Defender tamperingRclone or archive-based exfiltration staging.encrypted file creation bursts!!!README_FIRST!!!.txt ransom note

ATT&CK IDs¹

T1190 Exploit Public-Facing ApplicationT1098 Account ManipulationT1003 OS Credential DumpingT1021 Remote ServicesT1219 Remote Access SoftwareT1572 Protocol TunnelingT1562.001 Impair DefensesT1560 Archive Collected DataT1567 Exfiltration Over Web ServiceT1486 Data Encrypted for Impact

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported 8¹IntelliOS retained 0

8 IOCs are reported by SOCRadar, but the underlying observable values are not yet retained in IntelliOS. The profile therefore cites the source count without republishing unstored IOC values.

Source coverage: 1 source group tracked; 0 currently contribute retained observable or context rows.

Retained Public Observables¹

8 IOCs are reported by SOCRadar, but the underlying observable values are not yet retained in IntelliOS. The profile therefore cites the source count without republishing unstored IOC values.

Source	Reported	Retained	Coverage Status
SOCRadar¹	8	0	Reported IOC count retained; underlying SOCRadar feed values are not republished unless stored as cited public observables.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

Flash Threat Intel Brief

N-able N-central Authentication Bypass Under Active Exploitation

Exact related IntelliOS product link retained from /vault/n-able-n-central-authentication-bypass-active-exploitation.

Flash Threat Intel Brief

ScreenConnect Exploitation Creates MSP-to-Customer Ransomware Exposure

Exact related IntelliOS product link retained from /vault/screenconnect-msp-ransomware-exposure.

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Storm-1175	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Storm-1175	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Storm-1175.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor	Threat actor directory source for profile fields and reported activity.
2	N-able N-central Authentication Bypass Under Active Exploitation /vault/n-able-n-central-authentication-bypass-active-exploitation	IntelliOS Flash Threat Brief
3	N-central Authentication-Bypass Exploitation /threat-actor-cards/campaigns/ncentral-authentication-bypass-exploitation	CARDS Campaign
4	ScreenConnect Exploitation and Storm-1175 / Medusa Operations /threat-actor-cards/campaigns/screenconnect-medusa-storm-1175	CARDS Campaign
5	Microsoft Threat Intelligence: Storm-1175 https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/	Primary Threat Research
6	BleepingComputer: StormEncryptor https://www.bleepingcomputer.com/news/security/new-stormencryptor-ransomware-used-by-former-medusa-affiliate/	Current Corroborating Report

Loading Threat Actor Cards

Storm-1175

Top 10 Talking Points

Storm-1175 should be treated as an intrusion cluster, not a single immutable toolkit.1

Initial access should be scoped across identity and Internet-facing systems.1

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1

Identity compromise is a central scoping issue.1

Persistence matters more than the first payload.1

Legitimate administration tools may carry much of the attack.1

The actor may reduce visibility before the main objective is reached.1

Collection and exfiltration reveal the likely mission.1

Victimology helps prioritize business processes, not prove attribution.1

The first briefing should separate containment confidence from attribution confidence.1

BLUF

Storm-1175 should be treated as an intrusion cluster, not a single immutable toolkit.1

Initial access should be scoped across identity and Internet-facing systems.1

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1

Identity compromise is a central scoping issue.1

Persistence matters more than the first payload.1

Legitimate administration tools may carry much of the attack.1

The actor may reduce visibility before the main objective is reached.1

Collection and exfiltration reveal the likely mission.1

Victimology helps prioritize business processes, not prove attribution.1

The first briefing should separate containment confidence from attribution confidence.1

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

N-able N-central Authentication Bypass Under Active Exploitation

ScreenConnect Exploitation Creates MSP-to-Customer Ransomware Exposure

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Storm-1175 should be treated as an intrusion cluster, not a single immutable toolkit.¹

Initial access should be scoped across identity and Internet-facing systems.¹

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.¹

Identity compromise is a central scoping issue.¹

Persistence matters more than the first payload.¹

Legitimate administration tools may carry much of the attack.¹

The actor may reduce visibility before the main objective is reached.¹

Collection and exfiltration reveal the likely mission.¹

Victimology helps prioritize business processes, not prove attribution.¹

The first briefing should separate containment confidence from attribution confidence.¹

Storm-1175 should be treated as an intrusion cluster, not a single immutable toolkit.¹

Initial access should be scoped across identity and Internet-facing systems.¹

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.¹

Identity compromise is a central scoping issue.¹

Persistence matters more than the first payload.¹

Legitimate administration tools may carry much of the attack.¹

The actor may reduce visibility before the main objective is reached.¹

Collection and exfiltration reveal the likely mission.¹

Victimology helps prioritize business processes, not prove attribution.¹

The first briefing should separate containment confidence from attribution confidence.¹