[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVRnLxgS47ZDc9moQ8L4eMIRZu2dO1vdUpcbWXIjJM4A":3,"$fZ2PTObGlb80hceiwi-dykJSNRjkw3xVuc1omgC8bTBo":104},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":101,"created_at":102,"updated_at":103,"published_at":38},"storm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass","Storm-1175 deploys new StormEncryptor ransomware, likely via N-central auth bypass","Microsoft says the financially motivated actor, previously a Medusa ransomware user, has switched to a new C++ locker, with CVE-2026-18577 in N-able N-central the likely way in.","Microsoft Threat Intelligence has observed Storm-1175, a financially motivated actor it previously linked to Medusa ransomware, deploying a new C++ ransomware strain called StormEncryptor, with exploitation of the N-able N-central authentication bypass CVE-2026-18577 the likely route in.",[10,11,12,13,14],"StormEncryptor","Storm-1175","N-central NCM","CVE-2026-18577","Medusa","# Storm-1175 deploys new StormEncryptor ransomware, likely via N-central auth bypass\n\n*Microsoft says the financially motivated actor, previously a Medusa ransomware user, has switched to a new C++ locker, with CVE-2026-18577 in N-able N-central the likely way in.*\n\n**Tags:** `StormEncryptor` `Storm-1175` `N-able N-central` `CVE-2026-18577` `Medusa`\n\n> Microsoft Threat Intelligence has observed Storm-1175, a financially motivated actor it previously linked to Medusa ransomware, deploying a new C++ ransomware strain called StormEncryptor, with exploitation of the N-able N-central authentication bypass CVE-2026-18577 the likely route in.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | KEV | Fixed in |\n|---|---|---|---|\n| CVE-2026-18577 | 8.1 (NVD, v3.1); 8.2 (N-able, v4.0) | ✅ added 3 August 2026 | N-central 2026.3.1.7 (HF1), superseded by 2026.3.1.10 (HF2) |\n\n## New StormEncryptor ransomware strain\n\nMicrosoft Threat Intelligence has identified a new ransomware strain, StormEncryptor, deployed by the threat actor it tracks as Storm-1175, a financially motivated group. The C++ payload appends the `.encrypted` extension to files and drops a ransom note named `!!!README_FIRST!!!.txt` in every directory it scans. Microsoft Defender detects it as `Ransom:Win64\u002FStormEncryptor`.\n\n\"Storm-1175's deployment of StormEncryptor marks the threat actor's first activity observed by Microsoft Threat Intelligence since April 2026, and a shift away from Medusa ransomware,\" Microsoft said. \"This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days.\"\n\n## Likely initial access via CVE-2026-18577\n\nMicrosoft says the StormEncryptor deployments were likely preceded by exploitation of CVE-2026-18577, an authentication bypass in N-able's N-central remote monitoring and management (RMM) platform. NVD describes the flaw as an incomplete patch for CVE-2026-18556 that allows authentication bypass and account takeover in N-central versions through 2026.3.1.\n\nN-able released N-central 2026.3 Hotfix 1 (build 2026.3.1.7) on 2 August 2026, the same day the StormEncryptor activity began, according to BankInfoSecurity. It followed with Hotfix 2 (build 2026.3.1.10) on 6 August, which supersedes Hotfix 1 with additional hardening and, per a 12 August update, blocks a related attack path. NVD rates the flaw 8.1 under CVSS v3.1; N-able's CVSS v4.0 score is 8.2. CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities (KEV) catalog on 3 August 2026.\n\n## Post-compromise tooling\n\nMicrosoft lists the following post-compromise activity in the new campaign:\n\n- AnyDesk or SimpleHelp for remote access and management\n- Advanced IP Scanner for network discovery\n- Mimikatz to dump credentials from LSASS memory\n\nAfter access, the group moves to data exfiltration and then deploys StormEncryptor, typically within a few days of initial access.\n\n## Who is Storm-1175\n\nStorm-1175 is a financially motivated threat actor tracked by Microsoft. BleepingComputer describes it as believed to be China-based, and BankInfoSecurity describes it as China-linked. The group was previously associated with Medusa ransomware.\n\nBefore this campaign, the group exploited zero-day and n-day flaws in internet-facing software, including GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Ivanti Connect Secure and JetBrains TeamCity, according to BleepingComputer.\n\n## Victims and impact\n\nBankInfoSecurity reports that victims listed on the group's ransom site come from e-commerce, fintech, healthcare and home security. The ransom note gives victims three days to make contact, after which the attackers threaten to leak stolen data.\n\nN-able says its Adlumin MDR service detected unusual activity in a customer environment on 31 July 2026, leading to the discovery of the zero-day exploitation.\n\n## Key points\n\n- Microsoft has observed Storm-1175, a financially motivated actor previously linked to Medusa ransomware, deploying a new C++ ransomware strain, StormEncryptor.\n- Microsoft says the attacks were likely preceded by exploitation of CVE-2026-18577, an authentication bypass in N-able N-central, added to CISA KEV on 3 August 2026.\n- Post-compromise tooling includes AnyDesk or SimpleHelp, Advanced IP Scanner and Mimikatz for LSASS credential dumping.\n- StormEncryptor appends `.encrypted` to files and drops a `!!!README_FIRST!!!.txt` ransom note in every scanned directory.\n- N-able shipped Hotfix 1 (build 2026.3.1.7) on 2 August and Hotfix 2 (build 2026.3.1.10) on 6 August; Hotfix 2 is required even where Hotfix 1 was applied.\n\n## Further reading & sources\n\n- [New StormEncryptor ransomware used by former Medusa affiliate](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-stormencryptor-ransomware-used-by-former-medusa-affiliate\u002F) (BleepingComputer)\n- [N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F08\u002F10\u002Fcve-2026-18577-n-central-hotfix-2-msps\u002F) (Help Net Security)\n- [Storm-1175 Launches StormEncryptor Ransomware Attacks Using N-able Security Flaw](https:\u002F\u002Fgbhackers.com\u002Fstorm-1175-launches-stormencryptor-ransomware-attacks) (GBHackers)\n- [China-Linked Hackers Use N-able Flaw in Ransomware Attacks](https:\u002F\u002Fwww.bankinfosecurity.com\u002Fchina-linked-hackers-exploit-n-able-flaw-in-ransomware-attacks-a-32506) (BankInfoSecurity)\n- [N-central 2026.3 Hotfix 2: additional mitigation for CVE-2026-18577](https:\u002F\u002Fstatus.n-able.com\u002F2026\u002F08\u002F06\u002Fn-central-2026-3-hotfix-2-additional-mitigation-for-cve-2026-18577\u002F) (N-able)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstorm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass.png?v=316922394f",{"cves":18,"actors":32,"malware":39,"targets":50,"timeline":55,"industries":82,"technologies":91},[19,28],{"id":20,"kev":21,"poc":21,"url":22,"cvss":23,"epss":24,"risk_band":25,"risk_score":26,"cvss_version":27},"CVE-2026-18556",true,"\u002Fvulnerabilities\u002FCVE-2026-18556",8.2,0.0788,"High",70.33,"4.0",{"id":13,"kev":21,"poc":21,"url":29,"cvss":23,"epss":30,"risk_band":25,"risk_score":31,"cvss_version":27},"\u002Fvulnerabilities\u002FCVE-2026-18577",0.1462,75.83,[33],{"url":34,"name":35,"slug":36,"type":37,"origin":38,"motivation":38},"\u002Fthreat-groups\u002Fstorm","Storm","storm","ransomware",null,[40,41,43,45,47,49],{"name":10},{"name":42},"AnyDesk",{"name":44},"Mimikatz",{"name":46},"SimpleHelp",{"name":48},"Advanced IP Scanner",{"name":14},[51],{"name":52,"sector":53,"status":54,"geography":38},"N-able","IT","confirmed",[56,60,63,67,71,74,78],{"date":57,"event":58,"description":59},"2026-07-31","Detection","N-able’s Adlumin MDR solution detected unusual activity within a customer’s environment, leading to the discovery of a threat actor actively exploiting a zero-day vulnerability in an N-central server.",{"date":57,"event":61,"description":62},"Zero-day detected","N-able first detected the actively exploited zero-day",{"date":64,"event":65,"description":66},"2026-08-01","Exploitation","First detection of exploitation of CVE-2026-18577",{"date":68,"event":69,"description":70},"2026-08-02","Campaign start","StormEncryptor deployment begins",{"date":68,"event":72,"description":73},"Advisory published","N-able published security advisory for CVE-2026-18577",{"date":75,"event":76,"description":77},"2026-08-10","Hotfix","N-able released second security hotfix for N-central",{"date":79,"event":80,"description":81},"2026-08-12","Update","N-able clarified Hotfix 2 blocks a related attack path and expanded IOC list",[83,87],{"url":84,"name":85,"slug":86},"\u002Findustries\u002Ftechnology","Technology","technology",{"url":88,"name":89,"slug":90},"\u002Findustries\u002Finformation-technology-services","Information Technology Services","information-technology-services",[92,94,97,99],{"vendor":52,"product":93},"N-central RMM",{"vendor":95,"product":96},"GoAnywhere","GoAnywhere MFT",{"vendor":52,"product":98},"N-central",{"vendor":52,"product":100},"N-able products","ransomware_incident","2026-09-26T07:12:34.821288+00:00","2026-10-16T12:28:06.746449+00:00",{"articles":105},[106,116,128,139],{"slug":107,"title":108,"summary":109,"tags":110,"hero_image_url":114,"story_type":101,"created_at":115},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor","Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.",[111,13,10,112,113],"N-able N-central","Ransomware","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":117,"title":118,"summary":119,"tags":120,"hero_image_url":126,"story_type":101,"created_at":127},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Claims Troutman Pepper Locke Leak as Its Site Lists 64 Law Firms","Silent Ransom Group's leak site listed 64 law firms in August 2026, according to DataBreaches.net, and the group claims it leaked data taken from Troutman Pepper Locke. The firm says an employee was targeted by social engineering and sent documents to an unauthorised party, but that no one gained access to its environment.",[121,122,123,124,125,37],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":129,"title":130,"summary":131,"tags":132,"hero_image_url":137,"story_type":101,"created_at":138},"dragonforce-ransomware-hits-saudi-chemical-manufacturer","DragonForce Ransomware Claims Attack on Saudi Chemical Manufacturer","DragonForce has claimed an attack on a Saudi Arabian chemical manufacturer, listed in AhnLab ASEC's dark web roundup of 16 July 2026. The claim comes from the group itself and has not been independently confirmed. Industry trackers count DragonForce among the most active ransomware operations of Q2 2026, though their victim totals differ.",[133,112,134,135,136],"DragonForce","Saudi Arabia","Chemical Manufacturing","ASEC","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdragonforce-ransomware-hits-saudi-chemical-manufacturer.png?v=789ad783bf","2026-09-19T12:09:53.129912+00:00",{"slug":140,"title":141,"summary":142,"tags":143,"hero_image_url":148,"story_type":101,"created_at":149},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Extortion Group Has Listed More Than 200 Claimed Victims","CoinbaseCartel, a data-theft extortion group that appeared in September 2025, has 207 claimed victims on ransomware.live, 76 of them in the US; researchers link its access mainly to reused infostealer credentials, while a suggested tie to the Scattered LAPSUS$ Hunters ecosystem remains unconfirmed.",[37,144,145,146,147],"data-exfiltration","coinbasecartel","dark-web","extortion","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00"]