A financially motivated threat actor, previously linked to the Medusa ransomware operation, has been observed deploying a new ransomware strain named StormEncryptor. Microsoft Threat Intelligence, which tracks this actor as Storm-1175, indicates that recent attacks likely leveraged an authentication-bypass vulnerability, CVE-2026-18577, in the N-central remote monitoring and management (RMM) tool.
Storm-1175 is believed to be based in China and has a history of exploiting zero-day and N-day vulnerabilities in various products, including GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Ivanti Connect Secure, and JetBrains TeamCity. The deployment of StormEncryptor marks the first activity observed from Storm-1175 by Microsoft Threat Intelligence since April 2026, signaling a shift away from their previous use of Medusa ransomware.
The StormEncryptor malware is written in C++ and appends the `.encrypted` filename extension to encrypted files. It drops a ransom note titled `!!!README_FIRST!!!.txt` in every scanned directory. This note gives victims a three-day window to contact the attackers for ransom negotiation, threatening to leak stolen data online if payment is not made.
Upon gaining initial access to a target network, Storm-1175 utilizes tools like AnyDesk or SimpleHelp for remote management, Advanced IP Scanner for network discovery, and Mimikatz to extract credentials from the Local Security Authority Subsystem Service (LSASS) process. Microsoft emphasizes that this threat actor moves rapidly from initial compromise to data exfiltration and ransomware deployment, often completing these stages within a few days.
N-able, the vendor of the N-central RMM tool, addressed the CVE-2026-18577 vulnerability with a hotfix, 2026.3 HF1 (build 2026.3.1.7), released on August 2. The company urged customers to install this patch immediately.
N-able previously advised administrators to look for indicators of compromise, such as an `svchost.exe` file located in users' device Documents folders, a registered service named "Cloudflared," and inbound connections from specific IP addresses detailed in their advisory. Organizations are encouraged to monitor for Storm-1175 activity and apply security patches promptly to mitigate risks.
