Storm-1175 (GoAnywhere and Medusa) threat actor profile: How fast edge exploits become Medusa ransomware

Storm-1175 turns a newly disclosed flaw in an internet-facing server into a Medusa ransomware deployment, sometimes inside 24 hours. Microsoft Threat Intelligence has tracked the group exploiting more than 16 vulnerabilities since 2023, including at least three zero-days, among them the GoAnywhere MFT License Servlet flaw CVE-2025-10035. This profile is built from Microsoft's two primary reports (October 2025 and April 2026), the FBI, CISA and MS-ISAC Medusa advisory AA25-071A, Fortra's own advisory and MITRE ATT&CK v20. It covers names, targeting, techniques, the way the group turns stolen credentials into domain-wide control, and the detections and controls that break the chain. It is for SOC, vulnerability and identity teams; no individuals are named.

Key takeaways

• Your patch window is the attack window. Microsoft saw SAP NetWeaver CVE-2025-31324 exploited one day after disclosure, and GoAnywhere and SmarterMail flaws exploited about a week before disclosure, so emergency patching and exposure reduction matter more than routine cycles.
• A web-facing server is only the door. Every documented intrusion moves quickly from the exploited host to new local administrators, RMM agents and LSASS dumps, so post-exploitation detection on those servers is the real control point.
• Credentials do the spreading. Impacket and Mimikatz LSASS dumps, a WDigest registry change, passwords pulled from Veeam and an NTDS.dit dump from a domain controller turn one foothold into domain-wide access.
• Legitimate tools carry the payload. PDQ Deployer, Group Policy, PsExec, renamed Cloudflare tunnels, Rclone and eight named RMM products all appear in Microsoft's reporting, so allowlisting and baseline behaviour beat signature hunting.
• Microsoft's recommendations are specific. Credential Guard, tamper protection, attack surface reduction rules against LSASS theft, PsExec and web shells, MFA on approved RMM tools and limits on local admin rights address most of the observed behaviour.

Who they are (names and aliases)

Storm-1175 is a Microsoft designation. Under Microsoft's naming scheme, a "Storm-" prefix marks a developing cluster that has not yet been given a weather-family name. Microsoft describes Storm-1175 as a financially motivated cybercriminal actor known for deploying Medusa ransomware and for exploiting public-facing applications for initial access. Its April 2026 report does not attribute the group to a country. Some news coverage in August 2026 relayed a belief that the group is China-based; Microsoft's published blog reporting does not make that attribution, so this page does not either.

See the Medusa Ransomware Threat Actor Profile for the wider operation and the Threat Actor Groups Guide for how vendor naming schemes relate.

Targeting and motivation

• Motivation: financial, through double extortion. Data is collected and exfiltrated before encryption and the victim is threatened with publication on Medusa's leak site (ATT&CK T1486 Data Encrypted for Impact, T1657 Financial Theft).
• Sectors: Microsoft says healthcare was heavily affected, along with education, professional services and finance.
• Geographies: Microsoft names Australia, the United Kingdom and the United States.
• Selection: opportunistic by exposure. The group targets whatever web-facing system has a fresh, weaponised flaw, which means victim selection follows the vulnerability calendar, not a sector plan.
• Tempo: some intrusions reach ransomware within 24 hours of initial access; many take five to six days.

Vulnerabilities Microsoft attributes to Storm-1175

All CVEs below are in the CISA Known Exploited Vulnerabilities catalog, and CISA marks each with known ransomware use.

The pattern: edge systems that run with broad service privileges and hold credentials for other systems. See the MFT Security Guide and the Edge Device Exploitation Guide.

Tactics and techniques (MITRE ATT&CK)

Technique IDs are ATT&CK v20 and were checked against the v20 dataset. Defence evasion techniques now sit under TA0112 Defense Impairment or Stealth. The behaviour column summarises Microsoft's reporting; it is a detection reference, not a procedure.

See the Living off the Land Guide and the Lateral Movement Guide for detection depth on these technique families.

How they abuse identities and credentials

The exploits get the attention, but the intrusions succeed through identity weaknesses most estates share. Each stage below is a point where an identity control stops the chain.

• Service account context on the edge server: GoAnywhere, TeamCity, PaperCut and similar platforms run as service accounts with broad local rights. Microsoft saw RMM agents dropped directly under the GoAnywhere process, which means the application's service identity installed persistence. Run these services with least privilege and no interactive logon. See the Service Account Security Guide.
• Rogue local administrators: a new local account added to Administrators is the group's routine persistence step. Windows LAPS removes shared local admin passwords, and alerting on local group changes on servers catches the account. See the LAPS Guide.
• Cleartext credential caching: setting WDigest UseLogonCredential to 1 makes Windows keep plaintext passwords in LSASS memory for the next dump. Monitor HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest for changes. Credential Guard, which Microsoft says should be enabled before domain join or first domain sign-in, isolates the secrets these dumps target. See the Credential Dumping Guide.
• Backup platform as a credential vault: recovering stored passwords from Veeam gave the group credentials for other hosts. Backup servers store some of the most privileged non-human credentials in an estate. See the Veeam Hardening Guide and the Backup Identity Isolation Guide.
• Domain controller and NTDS.dit: once privileged, the group used PsExec to reach a domain controller and dump NTDS.dit, which exposes every domain account hash, including service accounts and krbtgt. Treat this as a full domain credential reset scenario. See the Domain Controller Hardening Guide.
• RMM and deployment tools as privileged identities: Microsoft notes RMM tools can create accounts and deliver payloads, and the group used PDQ Deployer and Group Policy to push ransomware. Any tool that can run code on every endpoint is a tier 0 identity and needs MFA, an allowlist and change alerting. See the RMM Tool Security Guide.

Notable incidents

Microsoft does not name victims. CISA added the N-central flaw to KEV on 3 August 2026.

Detection and defence

Detections to build first

• Web server spawning shells: PowerShell or cmd.exe whose parent is a Tomcat or application server process (Microsoft's GoAnywhere hunting queries use DeviceProcessEvents for exactly this), especially with whoami, net user, nltest, certutil, bitsadmin or DownloadString on the command line.
• GoAnywhere specific: Fortra advises checking logs for "Error parsing license response" entries whose stack trace includes SignedObject.getObject, and reviewing Admin Audit logs. Upgrading does not remove earlier compromise.
• New RMM agent on a server: install of any RMM product not on your approved list, or a new service launched from an application directory.
• Account changes: local account creation (event ID 4720) and additions to Administrators (4732) on servers, plus WDigest and Defender exclusion registry changes.
• Credential theft: LSASS access by non-security processes (Sysmon event ID 10), Task Manager dump files, ntdsutil or volume shadow copy access on domain controllers.
• Staging and exfiltration: Rclone or renamed copies (Microsoft lists lsp.exe), Bandizip on servers, and large uploads from servers to cloud storage.
• Mass deployment: new PDQ jobs, RunFileCopy.cmd, or new Group Policy links and scheduled tasks outside change windows.

Prevention priorities

1. Inventory every web-facing system with external attack surface scanning and take admin consoles (GoAnywhere's included, as Fortra advises) off the internet, behind a VPN, WAF, reverse proxy or DMZ. See the Attack Surface Management Guide.
2. Treat KEV entries with known ransomware use on internet-facing products as emergency changes, measured in hours. See the Vulnerability Prioritisation Guide.
3. Restrict outbound internet from servers through firewalls and proxies, which blocks RMM call-outs, tunnels and Rclone.
4. Enable the ASR rules Microsoft lists: block credential stealing from LSASS, block process creations from PsExec and WMI, block obfuscated scripts, block webshell creation for servers, block copied or impersonated system tools, and advanced ransomware protection. Pilot in audit mode first, then enforce.
5. Turn on tamper protection tenant-wide, DisableLocalAdminMerge and Credential Guard, and run EDR in block mode.
6. Remove shared local admin passwords with Windows LAPS and enforce MFA on approved RMM tools.
7. Keep immutable, offline backups with separately held credentials, and test restores, as AA25-071A advises.

Measuring it

• Median hours from KEV listing to patch or isolation for internet-facing systems (target under 48).
• Internet-reachable admin consoles (target zero).
• Percentage of servers with Credential Guard, tamper protection and the listed ASR rules in block mode.
• Count of unapproved RMM agents found per month, and time to removal.
• Percentage of servers with egress restricted to an allowlist.

If you suspect Storm-1175 activity, isolate the exploited server first, then assume credential exposure: reset local admin, service and backup credentials, and plan a krbtgt double reset if NTDS.dit was touched. See the Web Shell Response Playbook, the Unauthorised RMM Tool Playbook and the Ransomware Response and Recovery Guide.

Practitioner checklist

• Check every product in the CVE table against your estate and confirm fixed versions, including GoAnywhere 7.8.4 or 7.6.3.
• Hunt back in time: review GoAnywhere logs back to September 2025 for SignedObject.getObject errors and .jsp files in application directories.
• Move every admin console and file transfer management interface off the public internet.
• Alert on shells spawned by web and application server processes.
• Publish an approved RMM list, block the rest at egress and enforce MFA on approved tools.
• Deploy Windows LAPS, Credential Guard and tamper protection on servers, and monitor the WDigest UseLogonCredential value.
• Rotate credentials stored in backup software and give backup infrastructure its own identity domain.
• Treat PDQ, Group Policy and RMM administration as tier 0 and alert on changes outside change windows.
• Restrict server egress and alert on Rclone, renamed tunnel binaries and bulk uploads.
• Rehearse a domain-wide credential reset, krbtgt included.

Standards and references

• Microsoft Threat Intelligence: Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations
• Microsoft Threat Intelligence: Investigating active exploitation of CVE-2025-10035 GoAnywhere Managed File Transfer vulnerability
• CISA, FBI and MS-ISAC: #StopRansomware: Medusa Ransomware (AA25-071A)
• Fortra: Security advisory FI-2025-012, GoAnywhere MFT License Servlet (CVE-2025-10035)
• CISA: Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK: Medusa Group (G1051)
• MITRE ATT&CK: Medusa Ransomware (S1244)
• BleepingComputer: New StormEncryptor ransomware used by former Medusa affiliate

Related NHI Mgmt Group resources: Medusa Ransomware Threat Actor Profile · Storm-0501 Threat Actor Profile Guide · Ransomware Groups Guide · Top 10 Ransomware Initial Access Vectors · Cloudflare Tunnel and trycloudflare abuse