All news
ransomware incident

EdgeProtect

Storm-1175 deploys new StormEncryptor ransomware, likely via N-central auth bypass

Microsoft says the financially motivated actor, previously a Medusa ransomware user, has switched to a new C++ locker, with CVE-2026-18577 in N-able N-central the likely way in.

26 September 2026
StormEncryptorStorm-1175N-central NCMCVE-2026-18577Medusa
Storm-1175 deploys new StormEncryptor ransomware, likely via N-central auth bypass

At a glance

2 CVEs1 actor1 target2 industries

Vulnerabilities

CVECVSSEPSSKEVPoCPRS risk
CVE-2026-185568.27.9%ExploitedAvailable70 · High
CVE-2026-185778.214.6%ExploitedAvailable76 · High

Threat actors

NameTypeOriginMotivation
Stormransomware--

Targets & victims

OrganisationSectorRegionStatus
N-ableIT-confirmed

Industries

TechnologyInformation Technology Services

Technology affected

N-able · N-central RMMGoAnywhere · GoAnywhere MFTN-able · N-centralN-able · N-able products

Malware & tooling

StormEncryptorAnyDeskMimikatzSimpleHelpAdvanced IP ScannerMedusa

Timeline

  1. Detection

    N-able’s Adlumin MDR solution detected unusual activity within a customer’s environment, leading to the discovery of a threat actor actively exploiting a zero-day vulnerability in an N-central server.

  2. Zero-day detected

    N-able first detected the actively exploited zero-day

  3. Exploitation

    First detection of exploitation of CVE-2026-18577

  4. Campaign start

    StormEncryptor deployment begins

  5. Advisory published

    N-able published security advisory for CVE-2026-18577

  6. Hotfix

    N-able released second security hotfix for N-central

  7. Update

    N-able clarified Hotfix 2 blocks a related attack path and expanded IOC list

Vulnerability details

CVE CVSS KEV Fixed in
CVE-2026-18577 8.1 (NVD, v3.1); 8.2 (N-able, v4.0) ✅ added 3 August 2026 N-central 2026.3.1.7 (HF1), superseded by 2026.3.1.10 (HF2)

New StormEncryptor ransomware strain

Microsoft Threat Intelligence has identified a new ransomware strain, StormEncryptor, deployed by the threat actor it tracks as Storm-1175, a financially motivated group. The C++ payload appends the .encrypted extension to files and drops a ransom note named !!!README_FIRST!!!.txt in every directory it scans. Microsoft Defender detects it as Ransom:Win64/StormEncryptor.

"Storm-1175's deployment of StormEncryptor marks the threat actor's first activity observed by Microsoft Threat Intelligence since April 2026, and a shift away from Medusa ransomware," Microsoft said. "This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days."

Likely initial access via CVE-2026-18577

Microsoft says the StormEncryptor deployments were likely preceded by exploitation of CVE-2026-18577, an authentication bypass in N-able's N-central remote monitoring and management (RMM) platform. NVD describes the flaw as an incomplete patch for CVE-2026-18556 that allows authentication bypass and account takeover in N-central versions through 2026.3.1.

N-able released N-central 2026.3 Hotfix 1 (build 2026.3.1.7) on 2 August 2026, the same day the StormEncryptor activity began, according to BankInfoSecurity. It followed with Hotfix 2 (build 2026.3.1.10) on 6 August, which supersedes Hotfix 1 with additional hardening and, per a 12 August update, blocks a related attack path. NVD rates the flaw 8.1 under CVSS v3.1; N-able's CVSS v4.0 score is 8.2. CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities (KEV) catalog on 3 August 2026.

Post-compromise tooling

Microsoft lists the following post-compromise activity in the new campaign:

  • AnyDesk or SimpleHelp for remote access and management
  • Advanced IP Scanner for network discovery
  • Mimikatz to dump credentials from LSASS memory

After access, the group moves to data exfiltration and then deploys StormEncryptor, typically within a few days of initial access.

Who is Storm-1175

Storm-1175 is a financially motivated threat actor tracked by Microsoft. BleepingComputer describes it as believed to be China-based, and BankInfoSecurity describes it as China-linked. The group was previously associated with Medusa ransomware.

Before this campaign, the group exploited zero-day and n-day flaws in internet-facing software, including GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Ivanti Connect Secure and JetBrains TeamCity, according to BleepingComputer.

Victims and impact

BankInfoSecurity reports that victims listed on the group's ransom site come from e-commerce, fintech, healthcare and home security. The ransom note gives victims three days to make contact, after which the attackers threaten to leak stolen data.

N-able says its Adlumin MDR service detected unusual activity in a customer environment on 31 July 2026, leading to the discovery of the zero-day exploitation.

Key points

  • Microsoft has observed Storm-1175, a financially motivated actor previously linked to Medusa ransomware, deploying a new C++ ransomware strain, StormEncryptor.
  • Microsoft says the attacks were likely preceded by exploitation of CVE-2026-18577, an authentication bypass in N-able N-central, added to CISA KEV on 3 August 2026.
  • Post-compromise tooling includes AnyDesk or SimpleHelp, Advanced IP Scanner and Mimikatz for LSASS credential dumping.
  • StormEncryptor appends .encrypted to files and drops a !!!README_FIRST!!!.txt ransom note in every scanned directory.
  • N-able shipped Hotfix 1 (build 2026.3.1.7) on 2 August and Hotfix 2 (build 2026.3.1.10) on 6 August; Hotfix 2 is required even where Hotfix 1 was applied.

Further reading & sources