# Storm-1175

> As of 2026-09-14, Storm-1175 is a CN-nexus threat actor tracked by Threadlinqs Intelligence across 3 threats spanning vulnerability, ransomware. ATT&CK coverage spans 52 techniques across 14 tactics in 3 of 3 tracked threats. Most-observed techniques: T1021 (Remote Services), T1059 (Command and Scripting Interpreter), T1071 (Application Layer Protocol).

- **Nation:** CN
- **Tracked threats:** 3
- **Categories:** VULNERABILITY, RANSOMWARE
- **As of:** 2026-09-14

## ATT&CK techniques observed

52 techniques observed across 3 of 3 tracked threats. Tactics: Discovery (11), Stealth (formerly Defense Evasion) (7), Command and Control (6), Execution (5), Persistence (5), Initial Access (4).

- [T1021](https://intel.threadlinqs.com/technique/T1021) Remote Services — Lateral Movement — observed in 3 of 3 tracked threats
- [T1059](https://intel.threadlinqs.com/technique/T1059) Command and Scripting Interpreter — Execution — observed in 3 of 3 tracked threats
- [T1071](https://intel.threadlinqs.com/technique/T1071) Application Layer Protocol — Command and Control — observed in 3 of 3 tracked threats
- [T1078](https://intel.threadlinqs.com/technique/T1078) Valid Accounts — Privilege Escalation — observed in 3 of 3 tracked threats
- [T1082](https://intel.threadlinqs.com/technique/T1082) System Information Discovery — Discovery — observed in 3 of 3 tracked threats
- [T1136](https://intel.threadlinqs.com/technique/T1136) Create Account — Persistence — observed in 3 of 3 tracked threats
- [T1190](https://intel.threadlinqs.com/technique/T1190) Exploit Public-Facing Application — Initial Access — observed in 3 of 3 tracked threats
- [T1219](https://intel.threadlinqs.com/technique/T1219) Remote Access Tools — Command and Control — observed in 3 of 3 tracked threats
- [T1486](https://intel.threadlinqs.com/technique/T1486) Data Encrypted for Impact — Impact — observed in 3 of 3 tracked threats
- [T1685](https://intel.threadlinqs.com/technique/T1685) Disable or Modify Tools — Defense Impairment — observed in 3 of 3 tracked threats
- [T1003](https://intel.threadlinqs.com/technique/T1003) OS Credential Dumping — Credential Access — observed in 2 of 3 tracked threats
- [T1018](https://intel.threadlinqs.com/technique/T1018) Remote System Discovery — Discovery — observed in 2 of 3 tracked threats
- [T1046](https://intel.threadlinqs.com/technique/T1046) Network Service Discovery — Discovery — observed in 2 of 3 tracked threats
- [T1069](https://intel.threadlinqs.com/technique/T1069) Permission Groups Discovery — Discovery — observed in 2 of 3 tracked threats
- [T1070](https://intel.threadlinqs.com/technique/T1070) Indicator Removal — Stealth (formerly Defense Evasion) — observed in 2 of 3 tracked threats

## Tracked threats

- [N-able N-central Authentication Bypass (CVE-2026-18577) Actively Exploited for Admin Takeover](https://intel.threadlinqs.com/threat/TL-2026-1830) — CRITICAL
- [ConnectWise ScreenConnect Path Traversal (CVE-2024-1708) Added to CISA KEV — Storm-1175 / Medusa Ransomware Active Exploitation](https://intel.threadlinqs.com/threat/TL-2026-0436) — HIGH
- [Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035)](https://intel.threadlinqs.com/threat/TL-2026-0326) — CRITICAL

## Related CVEs

20 CVEs referenced by tracked Storm-1175 activity.

- [CVE-2026-86218](https://intel.threadlinqs.com/cve/CVE-2026-86218)
- [CVE-2026-23760](https://intel.threadlinqs.com/cve/CVE-2026-23760)
- [CVE-2026-18577](https://intel.threadlinqs.com/cve/CVE-2026-18577)
- [CVE-2026-18556](https://intel.threadlinqs.com/cve/CVE-2026-18556)
- [CVE-2026-1731](https://intel.threadlinqs.com/cve/CVE-2026-1731)
- [CVE-2025-52691](https://intel.threadlinqs.com/cve/CVE-2025-52691)
- [CVE-2025-31161](https://intel.threadlinqs.com/cve/CVE-2025-31161)
- [CVE-2025-10035](https://intel.threadlinqs.com/cve/CVE-2025-10035)
- [CVE-2024-57728](https://intel.threadlinqs.com/cve/CVE-2024-57728)
- [CVE-2024-57727](https://intel.threadlinqs.com/cve/CVE-2024-57727)
- [CVE-2024-57726](https://intel.threadlinqs.com/cve/CVE-2024-57726)
- [CVE-2024-27199](https://intel.threadlinqs.com/cve/CVE-2024-27199)
- [CVE-2024-27198](https://intel.threadlinqs.com/cve/CVE-2024-27198)
- [CVE-2024-21887](https://intel.threadlinqs.com/cve/CVE-2024-21887)
- [CVE-2024-1709](https://intel.threadlinqs.com/cve/CVE-2024-1709)
- [CVE-2024-1708](https://intel.threadlinqs.com/cve/CVE-2024-1708)
- [CVE-2023-46805](https://intel.threadlinqs.com/cve/CVE-2023-46805)
- [CVE-2023-27351](https://intel.threadlinqs.com/cve/CVE-2023-27351)
- [CVE-2023-27350](https://intel.threadlinqs.com/cve/CVE-2023-27350)
- [CVE-2023-21529](https://intel.threadlinqs.com/cve/CVE-2023-21529)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/Storm-1175