Microsoft Details Storm-1175’s Exploitation and Medusa Ransomware Operations
Summary
Microsoft describes Storm-1175 exploiting web-facing vulnerabilities, using remote-management and credential-theft tools, and deploying Medusa ransomware. The report details observed attack techniques and recommends perimeter, credential, and endpoint defenses.
Key points
- Microsoft reports Storm-1175 has exploited web-facing applications, including Exchange OWA vulnerabilities CVE-2022-41080 and CVE-2022-41082, to gain initial access and deploy web shells or remote-access payloads.
- Microsoft says the actor exploited vulnerabilities in SmarterMail and GoAnywhere MFT before public disclosure, and also targeted vulnerable Oracle WebLogic systems; the specific WebLogic vulnerability was not identified.
- After gaining access, Storm-1175 has used admin accounts, PowerShell, PsExec, Cloudflare tunnels, RMM tools, Impacket, and PDQ Deployer for persistence, lateral movement, and payload delivery.
- Observed credential-theft methods include LSASS dumping, Mimikatz, enabling WDigest caching, recovering Veeam passwords, and accessing NTDS.dit and SAM data.
- Microsoft reports the actor uses Bandizip to collect files and Rclone to exfiltrate data, then deploys Medusa ransomware, sometimes through PDQ Deployer or Group Policy.
- Recommended defenses include reducing exposure of web-facing systems, using a VPN or WAF, limiting local administrator privileges, enabling Credential Guard and tamper protection, and monitoring for unauthorized RMM tools.
Article Details
- Attack Vectors
- Storm-1175 exploits public-facing application vulnerabilities, including Exchange OWA flaws, to gain initial access and deploy web shells or remote-access payloads.
- The actor has exploited vulnerabilities in SmarterMail and GoAnywhere MFT before public disclosure; exploitation of Oracle WebLogic instances was also reported, but the specific vulnerability was not identified.
- After gaining access, Storm-1175 creates local administrator accounts and uses PowerShell, PsExec, Cloudflare tunnels, RDP, RMM software, Impacket, and PDQ Deployer for persistence, lateral movement, and payload delivery.
- Credential theft includes LSASS dumping, Mimikatz, enabling WDigest credential caching, recovering Veeam passwords, and accessing NTDS.dit and SAM data.
- The actor tampers with Microsoft Defender settings and adds antivirus exclusions, then uses Bandizip to collect files and Rclone to exfiltrate data to attacker-owned cloud resources before deploying Medusa ransomware.
- Defensive Notes
- Scan and monitor the public-facing attack surface; isolate web-facing systems where possible, and protect necessary public-facing servers with a WAF, reverse proxy, or perimeter network.
- Use a VPN for access to web-facing systems and promptly patch exposed applications.
- Apply least privilege, limit local administrator rights, avoid shared local administrator passwords, and use Credential Guard to protect credentials.
- Enable tamper protection and configure DisableLocalAdminMerge to help prevent antivirus exclusions from being set through local administrator privileges.
- Enforce MFA and appropriate security settings for approved RMM software; investigate unapproved installations and reset associated account passwords.
- Use attack surface reduction rules to block credential theft from LSASS and process creation originating from PsExec and WMI commands.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 134[.]195[.]91[.]224 | SimpleHelp C2 infrastructure observed in identified Storm-1175 intrusions. |
| IPV4 | 185[.]135[.]86[.]149 | SimpleHelp C2 infrastructure observed in identified Storm-1175 intrusions. |
| IPV4 | 85[.]155[.]186[.]121 | SimpleHelp C2 infrastructure observed in identified Storm-1175 intrusions. |
| SHA256 | 0cefeb6210b7103fd32b996beff518c9b6e1691a97bb1cda7f5fb57905c4be96 | Hash of Gaze.exe, identified in the article as a Medusa ransomware binary associated with Storm-1175 attacks. |
| SHA256 | 5ba7de7d5115789b952d9b1c6cff440c9128f438de933ff9044a68fff8496d19 | Hash of moon.exe, identified as SimpleHelp in Storm-1175 attack indicators. |
| SHA256 | 9632d7e4a87ec12fdd05ed3532f7564526016b78972b2cd49a610354d672523c | Hash of lsp.exe, identified as Rclone in Storm-1175-related intrusions; the article notes it was also seen in ransomware intrusions by other actors. |
| SHA256 | e57ba1a4e323094ca9d747bfb3304bd12f3ea3be5e2ee785a3e656c3ab1e8086 | Hash of main.exe, identified as SimpleHelp in Storm-1175 attack indicators. |
MITRE ATT&CK
T1003.001 · LSASS MemoryThe actor dumps LSASS credentials, including with Task Manager, Impacket, or Mimikatz.T1003.003 · NTDSStorm-1175 accesses NTDS.dit on a domain controller to obtain Active Directory account data and passwords.T1021 · Remote ServicesThe actor enables Remote Desktop by modifying Windows Firewall policy and uses RDP for lateral movement.T1036 · MasqueradingCloudflare tunnels are renamed to resemble legitimate binaries such as conhost.exe.T1059.001 · PowerShellStorm-1175 uses regular and encoded PowerShell commands, including to add antivirus exclusions.T1072 · Software Deployment ToolsStorm-1175 abuses PDQ Deployer for lateral movement and broad deployment of payloads, including ransomware.T1078 · Valid AccountsThe actor uses obtained administrator credentials and valid accounts for privileged actions and lateral movement.T1112 · Modify RegistryThe actor modifies registry settings to enable WDigest credential caching and tamper with Microsoft Defender Antivirus.T1136 · Create AccountStorm-1175 creates local user accounts and adds them to the administrators group.T1190 · Exploit Public-Facing ApplicationStorm-1175 gains initial access by exploiting vulnerabilities in public-facing applications, including Exchange OWA.T1219 · Remote Access ToolsThe actor repurposes RMM software, including Atera RMM, AnyDesk, and SimpleHelp, for persistence, remote access, and payload delivery.T1505.003 · Web ShellThe actor deploys web shells to establish an initial foothold and maintain control.T1562.001 · Disable or Modify ToolsStorm-1175 modifies Defender settings, turns off protections, and adds antivirus exclusions to allow payloads to run.T1567 · Exfiltration Over Web ServiceThe actor uses Rclone to exfiltrate data to attacker-owned cloud resources.T1572 · Protocol TunnelingStorm-1175 uses Cloudflare tunnels to relay remote sessions and move laterally over RDP.
CVE
CVE-2025-10035Fortra · GoAnywhere MFTin SmarterMail, which was exploited by Storm-1175 the week prior to public disclosure, and CVE-2025-10035 in GoAnywhere Managed File Transfer, also exploited one week before public disclosure.CVE-2026-23760SmarterTools · SmarterMailwe have also observed the use of at least three zero-day vulnerabilities including, most recently, CVE-2026-23760 in SmarterMail, which was exploited by Storm-1175 the week prior to public disclosure, and
Threat Actors
Malware
Vendors
Products
AnyDeskand management (RMM) products (Atera, Level RMM, N-able, DWAgent, MeshAgent, ConnectWise ScreenConnect, AnyDesk, SimpleHelp) for persistence, remote access, and payload deployment.Atera RMM[T1219] Remote Access Software – Legitimate RMM and remote access tools are repurposed for persistence and interactive remote control: ‘Storm-1175 has a rotation of tools… Atera RMM… AnyDesk… SimpleHelp’.ConnectWise ScreenConnectremote monitoring and management (RMM) products (Atera, Level RMM, N-able, DWAgent, MeshAgent, ConnectWise ScreenConnect, AnyDesk, SimpleHelp) for persistence, remote access, and payload deployment.DWAgentheavily abuses legitimate remote monitoring and management (RMM) products (Atera, Level RMM, N-able, DWAgent, MeshAgent, ConnectWise ScreenConnect, AnyDesk, SimpleHelp) for persistence, remote access, and payloadExchange OWAmultiple public-facing application vulnerabilities—including CVEâ2022â41080/CVEâ2022â41082 in Exchange OWA—to gain initial access, deploy web shells or remote access payloads, and rapidly move to MedusaFortra GoAnywhere MFTzero-days and N-day flaws (e.g., CVEâ2026â23760 in SmarterMail and CVEâ2025â10035 in GoAnywhere MFT), abused LOLBins, RMM tools, Impacket, PDQ Deployer, and Rclone for credential theft, lateralLevel RMMStorm-1175 heavily abuses legitimate remote monitoring and management (RMM) products (Atera, Level RMM, N-able, DWAgent, MeshAgent, ConnectWise ScreenConnect, AnyDesk, SimpleHelp) for persistence, remote access, andMeshAgentabuses legitimate remote monitoring and management (RMM) products (Atera, Level RMM, N-able, DWAgent, MeshAgent, ConnectWise ScreenConnect, AnyDesk, SimpleHelp) for persistence, remote access, and payload deployment.Microsoft Defender Antimalware PlatformDefensive tampering includes modifying Microsoft Defender registry settings and adding drive exclusions via encoded PowerShell; recommended mitigations include perimeter scanning, isolation/WAF/VPN, Credential Guard,Microsoft Defender External Attack Surface Managementyour digital footprint—such as through the use of public scanning interfaces like Microsoft Defender External Attack Surface Management—is essential to defending against perimeter network attacks.Microsoft Defender XDRConfigure automatic attack disruption in Microsoft Defender XDR.N-AbleStorm-1175 heavily abuses legitimate remote monitoring and management (RMM) products (Atera, Level RMM, N-able, DWAgent, MeshAgent, ConnectWise ScreenConnect, AnyDesk, SimpleHelp) for persistence, remote access, andOracle WebLogicStorm-1175 has exploited both Windows and Linux targets (including suspected Oracle WebLogic exploitation) and used at least three zero-days, such as CVEâ2026â23760 (SmarterMail) and CVEâ2025â10035 (GoAnywhereSimpleHelp(RMM) products (Atera, Level RMM, N-able, DWAgent, MeshAgent, ConnectWise ScreenConnect, AnyDesk, SimpleHelp) for persistence, remote access, and payload deployment.SmarterMailThe actor has also leveraged zero-days and N-day flaws (e.g., CVEâ2026â23760 in SmarterMail and CVEâ2025â10035 in GoAnywhere MFT), abused LOLBins, RMM tools, Impacket, PDQ Deployer, and Rclone for credential
Tools
BandizipData exfiltration commonly uses Bandizip for collection and Rclone for synchronization to attacker-owned cloud resources, followed by Medusa ransomware deployment via PDQ Deployer or Group Policy changes for broadCloudflare tunnels[T1036] Masquerading – Adversary renames tools/tunnels to mimic legitimate binaries to evade detection: ‘Cloudflare tunnels (renamed to mimic legitimate binaries like conhost.exe)’.ImpacketCVEâ2026â23760 in SmarterMail and CVEâ2025â10035 in GoAnywhere MFT), abused LOLBins, RMM tools, Impacket, PDQ Deployer, and Rclone for credential theft, lateral movement, exfiltration, and Defender tamperingMimikatzCredential theft techniques include LSASS memory dumping, Mimikatz usage, enabling WDigest caching, extracting Veeam passwords, and dumping NTDS.dit/SAM from domain controllers to escalate and proliferate access.PDQ Deployerin SmarterMail and CVEâ2025â10035 in GoAnywhere MFT), abused LOLBins, RMM tools, Impacket, PDQ Deployer, and Rclone for credential theft, lateral movement, exfiltration, and Defender tampering to enablePowerShellby creating local admin accounts, modifying Defender settings, and using living-off-the-land binaries (PowerShell, PsExec) plus tools like Impacket and PDQ Deployer to move laterally and deliver payloads.PsExeclocal admin accounts, modifying Defender settings, and using living-off-the-land binaries (PowerShell, PsExec) plus tools like Impacket and PDQ Deployer to move laterally and deliver payloads.RCloneand CVEâ2025â10035 in GoAnywhere MFT), abused LOLBins, RMM tools, Impacket, PDQ Deployer, and Rclone for credential theft, lateral movement, exfiltration, and Defender tampering to enable double-extortion