Microsoft Threat Intelligence has confirmed that the China-linked, financially motivated threat actor known as Storm-1175 has adopted a new ransomware strain, StormEncryptor, replacing its previous use of Medusa ransomware. The shift was observed beginning August 2, 2026, marking the first recorded activity of Storm-1175 deploying this new malware.
StormEncryptor is developed in C++ and, upon execution, encrypts files, appending the `.encrypted` extension. It then places a ransom note titled `!!!README_FIRST!!!.txt` in every directory it scans. This change in ransomware tooling suggests an evolution in the group's operational tactics.
While Microsoft has not definitively identified the initial access vulnerability for the current StormEncryptor campaign, it is considered highly probable that Storm-1175 is exploiting CVE-2026-18577. This authentication bypass vulnerability in N-able was publicly disclosed on August 2, 2026, and subsequently added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026.
Storm-1175 is recognized for its rapid, financially driven ransomware attacks, often leveraging newly disclosed vulnerabilities before organizations have an opportunity to apply patches. The group targets exposed systems and can move from initial access to data exfiltration and ransomware deployment within a matter of days, sometimes as quickly as 24 hours. This speed underscores the critical need for prompt patching and continuous monitoring.
The group primarily targets sectors such as healthcare, education, finance, and services across the United States, United Kingdom, and Australia. Their typical attack methodology involves chaining multiple exploits, establishing new accounts for persistence, moving laterally across networks using remote tools, stealing credentials, and weakening existing security defenses.
Since 2023, Microsoft Threat Intelligence has observed Storm-1175 exploiting over 16 vulnerabilities, often weaponizing them within days of public disclosure, or even before patches are available. Platforms previously targeted include Microsoft Exchange, Ivanti, ConnectWise, JetBrains, BeyondTrust, Papercut, SimpleHelp, CrushFTP, GoAnywhere MFT, and SmarterMail. Specific CVEs exploited include CVE-2026-1731 (BeyondTrust), CVE-2023-21529 (Microsoft Exchange), CVE-2023-27351 and CVE-2023-27350 (Papercut), CVE-2023-46805 and CVE-2024-21887 (Ivanti Connect Secure and Policy Secure), CVE-2024-1709 and CVE-2024-1708 (ConnectWise ScreenConnect), CVE-2024-27198 and CVE-2024-27199 (JetBrains TeamCity), CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 (SimpleHelp), CVE‑2025‑31161 (CrushFTP), CVE-2025-10035 (GoAnywhere MFT), and CVE-2025-52691 and CVE-2026-23760 (SmarterMail).
After gaining initial access, Storm-1175 installs web shells or remote access tools, creates administrative accounts, and moves laterally using tools like PowerShell, PsExec, RDP, and Cloudflare tunnels. They also abuse legitimate remote monitoring and management (RMM) tools and software such as PDQ Deployer and Impacket to spread across targeted networks. The group has demonstrated the capability to target both Windows and Linux systems and has, in some instances, exploited zero-day vulnerabilities prior to their public disclosure, indicating advanced capabilities.
