EdgeProtect
Threat News
Latest cyber threat intelligence, breaches and exploitation
2 matching stories
CVE-2026-18577Storm-1175 deploys new StormEncryptor ransomware, likely via N-central auth bypass
Microsoft Threat Intelligence has observed Storm-1175, a financially motivated actor it previously linked to Medusa ransomware, deploying a new C++ ransomware strain called StormEncryptor, with exploitation of the N-able N-central authentication bypass CVE-2026-18577 the likely route in.
N-central auth bypass CVE-2026-18577 exploited; Microsoft links attacks to StormEncryptor actor
Attackers exploited CVE-2026-18577, an incomplete patch for the N-able N-central authentication bypass CVE-2026-18556, to take over N-central servers and reach managed endpoints. Microsoft believes the actor may be Storm-1175, which has switched from Medusa to a new ransomware strain, StormEncryptor.
