Microsoft Threat Intelligence has disclosed that Storm-1175, a financially motivated threat actor attributed to China, has deployed a previously undocumented ransomware strain dubbed StormEncryptor. The campaign is believed to gain initial access through exploitation of N-able N-central, the remote monitoring and management (RMM) platform used heavily by managed service providers (MSPs) and internal IT teams. Notably, this represents a tooling shift: Storm-1175 previously deployed Medusa ransomware, and the move to a custom, C++-based encryptor signals an actor investing in proprietary capability rather than relying solely on ransomware-as-a-service affiliates.
If you run N-central — on-premises or hosted — or if you are a downstream client of an MSP that does, treat this as an active, confirmed exploitation scenario, not a theoretical one. RMM platforms are force multipliers for ransomware operators: one compromised N-central instance can yield administrative execution across every managed endpoint in the estate. The attack surface here is not a single server; it is your entire fleet.
This post breaks down what we know, how to hunt for StormEncryptor and Storm-1175 tradecraft today, and the concrete steps to harden your RMM infrastructure before this actor — or a copycat — reaches you.
Technical Analysis
Threat Actor and Malware
- Actor: Storm-1175 (Microsoft naming convention), financially motivated, linked to China.
- Payload: StormEncryptor — a previously undocumented ransomware family written in C++.
- Observable artifact: Encrypted files are appended with the extension
.encrypted. - Previous tooling: Medusa ransomware — indicating this actor operates with affiliate-level discipline and is willing to rotate payloads when existing tooling becomes burned or less effective.
A C++ encryptor is worth pausing on. Native-compiled ransomware typically means faster encryption throughput, smaller detection surface for script-based controls (AMSI, PowerShell logging), and easier cross-platform portability. Defenders relying primarily on script-interpreter telemetry will see less of the attack than they think.
Initial Access Vector: N-able N-central
Reporting indicates the intrusion likely leveraged a flaw in N-able N-central. RMM exploitation follows a depressingly consistent playbook that every defender should internalize:
- Exploit or abuse the RMM web interface / agent to achieve code execution on the N-central server or through the agent channel.
- Push tooling downstream — because RMM agents run with SYSTEM-level privileges by design, the attacker inherits trusted, high-privilege execution on every managed endpoint. This is why RMM compromise is categorized as a trusted-relationship / supply-chain-style intrusion (MITRE ATT&CK T1199, T1072).
- Stage and detonate ransomware — frequently after a dwell period involving credential theft, data staging for double extortion, and defense evasion (shadow copy deletion, backup tampering, AV neutralization via the RMM's own management capabilities).
The critical defensive insight: the malicious activity may not look malicious at the network or process level, because it arrives through a legitimately signed, expected management channel. Your detection strategy must therefore focus on behavioral anomalies within the RMM channel — unexpected scripts pushed at odd hours, agent processes spawning unusual children, and mass file-system modification — rather than on blocking the RMM tooling itself.
Exploitation Status
- Confirmed active exploitation in the wild per Microsoft Threat Intelligence's disclosure.
- No CVE identifier has been published in the source reporting at time of writing. Do not wait for a CVE number to act — treat internet-facing N-central instances as contested territory now.
- Monitor the N-able security advisories page and CISA KEV catalog for formal identifier assignment and patching deadlines.
Detection & Response
The detections below target the highest-fidelity observable behaviors from this campaign: the .encrypted file extension, anomalous child processes from RMM agents, and ransomware-standard defense evasion (shadow copy deletion). These are the signals a veteran SOC analyst would pivot on.
---
title: StormEncryptor Ransomware File Extension Activity
id: 3f9c1a72-8b44-4e2d-9a51-7c6d2e8f1a09
status: experimental
description: Detects creation or rename of files with the .encrypted extension associated with StormEncryptor ransomware deployed by Storm-1175. High volume of these events in a short window indicates active encryption.
references:
- https://thehackernews.com/2026/08/china-linked-hackers-deploy-new.html
- https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/08/20
tags:
- attack.impact
- attack.t1486
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: '.encrypted'
filter_legitimate_dirs:
TargetFilename|contains:
- '\Windows\WinSxS\'
- '\ProgramData\Microsoft\'
condition: selection and not filter_legitimate_dirs
falsepositives:
- Legitimate encrypted backup or archival tooling using similar extensions (rare)
level: high
---
title: Suspicious Child Process Spawned by N-able N-central Agent
id: 8d2e5b41-6f17-4c93-b7a2-1e9d4f6c8b35
status: experimental
description: Detects N-able N-central agent processes spawning command shells, scripting engines, or system utilities consistent with Storm-1175 post-exploitation activity pushed through the compromised RMM channel.
references:
- https://thehackernews.com/2026/08/china-linked-hackers-deploy-new.html
- https://attack.mitre.org/techniques/T1199/
- https://attack.mitre.org/techniques/T1072/
author: Security Arsenal
date: 2026/08/20
tags:
- attack.initial_access
- attack.t1199
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- '\N-able Technologies\'
- '\N-central\'
ParentImage|endswith:
- '\agent.exe'
- '\BASupSrvc.exe'
- '\winagent.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
- '\vssadmin.exe'
- '\wbadmin.exe'
- '\bcdedit.exe'
- '\net.exe'
- '\net1.exe'
condition: selection_parent and selection_child
falsepositives:
- Legitimate N-central automation policies and scheduled maintenance scripts — baseline your MSP's normal push schedule and investigate off-hours executions
level: high
---
title: Ransomware Shadow Copy and Backup Deletion
id: c47a9f23-2d68-4e81-a5b4-9f3c7d1e6a28
status: experimental
description: Detects deletion of volume shadow copies and backup catalog tampering via vssadmin, wmic, wbadmin, or bcdedit — a near-universal precursor to StormEncryptor and Medusa ransomware detonation.
references:
- https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/08/20
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: '\vssadmin.exe'
CommandLine|contains:
- 'delete shadows'
- 'resize shadowstorage'
selection_wmic:
Image|endswith: '\wmic.exe'
CommandLine|contains: 'shadowcopy'
selection_wbadmin:
Image|endswith: '\wbadmin.exe'
CommandLine|contains: 'delete catalog'
selection_bcdedit:
Image|endswith: '\bcdedit.exe'
CommandLine|contains:
- 'recoveryenabled no'
- 'ignoreallfailures'
condition: 1 of selection_*
falsepositives:
- Rare legitimate storage administration — any hit warrants immediate triage given ransomware context
level: critical
// Hunt: StormEncryptor / Storm-1175 activity across the estate
// Correlates .encrypted file artifacts, RMM-spawned suspicious children, and shadow copy deletion
// 1. Mass .encrypted file creation (active encryption indicator)
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName endswith ".encrypted" or FolderPath endswith ".encrypted"
| summarize EncryptedFileCount = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp), SampleFiles = make_set(strcat(FolderPath), 5) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine
| where EncryptedFileCount > 50
| sort by EncryptedFileCount desc
;
// 2. Suspicious child processes spawned by N-central agent components
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFolderPath has_any ("N-able Technologies", "N-central")
or InitiatingProcessFileName in~ ("agent.exe", "BASupSrvc.exe", "winagent.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "mshta.exe", "wscript.exe", "cscript.exe", "vssadmin.exe", "wbadmin.exe", "bcdedit.exe", "rundll32.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| sort by Timestamp desc
;
// 3. Ransomware anti-recovery behavior (shadow copy / backup deletion)
DeviceProcessEvents
| where Timestamp > ago(7d)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has_any ("delete shadows", "resize shadowstorage"))
or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy" and ProcessCommandLine has "delete")
or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete catalog")
or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "ignoreallfailures"))
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
-- Hunt: StormEncryptor precursor and impact artifacts
-- Surfaces shadow-copy deletion executions and .encrypted file artifacts on endpoints
-- Part 1: Processes matching ransomware anti-recovery and RMM-abuse patterns
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|delete catalog|recoveryenabled no|ignoreallfailures)'
OR Exe =~ '(?i)(N-able Technologies|N-central|winagent|BASupSrvc)'
-- Part 2: Recent .encrypted files on fixed drives (StormEncryptor impact artifact)
SELECT FullPath, Size, Mtime, Btime
FROM glob(globs='C:/Users/*/**/.encrypted*')
WHERE Mtime > now() - 86400
LIMIT 1000
-- Part 3: Ransom note-style files dropped alongside encryption
SELECT FullPath, Size, Mtime
FROM glob(globs='C:/Users/*/Desktop/*')
WHERE FullPath =~ '(?i)(readme|recover|decrypt|how_to)'
AND Mtime > now() - 172800
LIMIT 500
# Storm-1175 / StormEncryptor Hardening & Triage Script
# Run elevated on N-central servers and critical managed endpoints
# 1. Enumerate N-central components and agent installations for asset inventory
Get-WmiObject Win32_Product -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match 'N-central|N-able|Windows Agent' } |
Select-Object Name, Version, InstallDate | Format-Table -AutoSize
Get-Service | Where-Object { $_.DisplayName -match 'N-central|N-able|Windows Agent' } |
Select-Object Name, DisplayName, Status, StartType | Format-Table -AutoSize
# 2. Sweep for active encryption indicators (.encrypted files created in last 24h)
$cutoff = (Get-Date).AddHours(-24)
Get-ChildItem -Path 'C:\Users' -Recurse -Filter '*.encrypted' -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt $cutoff } |
Select-Object FullName, LastWriteTime -First 100 | Format-Table -AutoSize
# 3. Verify shadow copies exist and System Restore is functional
vssadmin list shadows
Get-ComputerRestorePoint -ErrorAction SilentlyContinue | Select-Object -Last 3
# 4. Enable Controlled Folder Access to blunt mass-encryption behavior
Set-MpPreference -EnableControlledFolderAccess Enabled
# 5. Ensure critical ransomware telemetry is enabled
Set-MpPreference -DisableRealtimeMonitoring $false
Set-MpPreference -DisableBehaviorMonitoring $false
Set-MpPreference -DisableIOAVProtection $false
# 6. Audit recent suspicious child processes of N-central agents (last 48h)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-48)} -ErrorAction SilentlyContinue |
Where-Object { $_.Message -match 'N-able|N-central|agent\.exe' -and
$_.Message -match 'cmd\.exe|powershell\.exe|vssadmin|wbadmin|bcdedit' } |
Select-Object TimeCreated, Message -First 50 | Format-List
# 7. Check RMM server exposure — flag internet-facing N-central web console listeners
Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue |
Where-Object { $_.LocalPort -in 80,443,8443,10000 } |
Select-Object LocalAddress, LocalPort, OwningProcess,
@{N='ProcessName';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
Format-Table -AutoSize
Remediation
- Inventory and isolate your N-central footprint immediately. Identify every N-central server (on-prem and hosted) and every endpoint running the agent. If any N-central management interface is reachable from the public internet, restrict it now — put it behind VPN, zero-trust access, or strict IP allowlisting. An internet-exposed RMM console is a standing invitation.
- Patch N-central to the latest release. Apply the most current N-able N-central build per the N-able security advisories page. No CVE has been formally published in the source reporting, so patch proactively rather than waiting for an identifier — active exploitation is already confirmed.
- Enforce MFA on all N-central and RMM administrative access. Credential theft against RMM consoles is a parallel path to exploitation. MFA on technician accounts is non-negotiable.
- Baseline legitimate RMM activity. Document your MSP's normal script-push schedules, approved automation policies, and authorized technician accounts. Alert on deviations — off-hours deployments, new scripts, newly created admin accounts.
- Harden anti-recovery defenses. Deploy the Sigma/KQL rules above for shadow copy deletion, enable Controlled Folder Access on high-value endpoints, and ensure backups are immutable/offline and not manageable through the same RMM plane that could be compromised.
- Hunt retrospectively. Run the KQL and VQL queries across a minimum 30-day lookback. Storm-1175 historically operated with Medusa before rotating to StormEncryptor — prior dwell time is likely, and
.encryptedfiles are the tripwire for active detonation. - Prepare the IR path now. If you find RMM-channel anomalies, assume the trust relationship is compromised: isolate the N-central server, rotate all credentials the RMM could touch (including service accounts and downstream admin creds), and engage your IR retainer before containment actions tip off the actor.
- If you're an MSP client, ask the hard question. Demand your provider confirm their N-central patch level, MFA posture, and monitoring coverage. Your exposure is inherited from theirs.
The broader lesson: RMM platforms have become the highest-leverage initial access target in the ransomware ecosystem because they convert one vulnerability into fleet-wide SYSTEM execution. Treat your RMM infrastructure with the same defensive rigor you apply to your identity plane — because to an attacker, they're the same thing.
Related Resources
Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.