New StormEncryptor ransomware used by former Medusa affiliate
StormEncryptor is a new ransomware strain deployed by a financially motivated threat actor known as Storm-1175, previously affiliated with the Medusa ransomware operation. The actor exploited an authentication-bypass vulnerability (CVE-2026-18577) in the N-central remote monitoring and management tool to gain initial access. After compromise, the attacker uses remote management tools and credential dumping to move quickly to data exfiltration and ransomware deployment. The ransomware encrypts files appending a .encrypted extension and leaves a ransom note demanding payment within three days or threatens data leakage. A hotfix addressing the exploited vulnerability was released by N-able on August 2, 2026. Organizations using self-hosted N-central servers are urged to apply this patch immediately and monitor for signs of compromise.
AI Analysis
Technical Summary
The StormEncryptor ransomware is a newly observed malware strain deployed by the threat actor Storm-1175, who was previously associated with the Medusa ransomware group. Microsoft Threat Intelligence links recent attacks to exploitation of CVE-2026-18577, an authentication-bypass vulnerability in the N-central RMM tool. Storm-1175 is believed to be China-based and has a history of exploiting zero-day and known vulnerabilities in various enterprise products. After initial access via the N-central vulnerability, the attacker uses AnyDesk or SimpleHelp for remote control, Advanced IP Scanner for network discovery, and Mimikatz to extract credentials from LSASS. The ransomware encrypts files with a .encrypted extension and drops a ransom note demanding negotiation within three days or data leakage. N-able released a hotfix (2026.3 HF1/build 2026.3.1.7) on August 2, 2026, to address the vulnerability. Microsoft warns that the threat actor moves rapidly from initial compromise to data theft and ransomware deployment, urging immediate patching and monitoring.
Potential Impact
The threat actor Storm-1175 can gain unauthorized access to networks by exploiting an authentication-bypass vulnerability in N-central RMM software, enabling remote control and credential theft. This leads to rapid data exfiltration and deployment of StormEncryptor ransomware, which encrypts files and threatens data leakage if ransom demands are not met within three days. The attack compromises confidentiality and availability of data and disrupts normal operations of affected organizations.
Mitigation Recommendations
A hotfix addressing CVE-2026-18577 was released by N-able on August 2, 2026 (version 2026.3 HF1/build 2026.3.1.7). Organizations using self-hosted N-central servers should apply this patch immediately. Additionally, administrators should monitor for indicators of compromise such as svchost.exe files in user Documents folders, a registered service named Cloudflared, and inbound connections from known malicious IP addresses as outlined in the vendor advisory. Microsoft recommends urgent patching and monitoring to prevent rapid exploitation by Storm-1175. No other mitigation actions are specified by the vendor advisory.
New StormEncryptor ransomware used by former Medusa affiliate
Description
StormEncryptor is a new ransomware strain deployed by a financially motivated threat actor known as Storm-1175, previously affiliated with the Medusa ransomware operation. The actor exploited an authentication-bypass vulnerability (CVE-2026-18577) in the N-central remote monitoring and management tool to gain initial access. After compromise, the attacker uses remote management tools and credential dumping to move quickly to data exfiltration and ransomware deployment. The ransomware encrypts files appending a .encrypted extension and leaves a ransom note demanding payment within three days or threatens data leakage. A hotfix addressing the exploited vulnerability was released by N-able on August 2, 2026. Organizations using self-hosted N-central servers are urged to apply this patch immediately and monitor for signs of compromise.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The StormEncryptor ransomware is a newly observed malware strain deployed by the threat actor Storm-1175, who was previously associated with the Medusa ransomware group. Microsoft Threat Intelligence links recent attacks to exploitation of CVE-2026-18577, an authentication-bypass vulnerability in the N-central RMM tool. Storm-1175 is believed to be China-based and has a history of exploiting zero-day and known vulnerabilities in various enterprise products. After initial access via the N-central vulnerability, the attacker uses AnyDesk or SimpleHelp for remote control, Advanced IP Scanner for network discovery, and Mimikatz to extract credentials from LSASS. The ransomware encrypts files with a .encrypted extension and drops a ransom note demanding negotiation within three days or data leakage. N-able released a hotfix (2026.3 HF1/build 2026.3.1.7) on August 2, 2026, to address the vulnerability. Microsoft warns that the threat actor moves rapidly from initial compromise to data theft and ransomware deployment, urging immediate patching and monitoring.
Potential Impact
The threat actor Storm-1175 can gain unauthorized access to networks by exploiting an authentication-bypass vulnerability in N-central RMM software, enabling remote control and credential theft. This leads to rapid data exfiltration and deployment of StormEncryptor ransomware, which encrypts files and threatens data leakage if ransom demands are not met within three days. The attack compromises confidentiality and availability of data and disrupts normal operations of affected organizations.
Defensive Guidance
A hotfix addressing CVE-2026-18577 was released by N-able on August 2, 2026 (version 2026.3 HF1/build 2026.3.1.7). Organizations using self-hosted N-central servers should apply this patch immediately. Additionally, administrators should monitor for indicators of compromise such as svchost.exe files in user Documents folders, a registered service named Cloudflared, and inbound connections from known malicious IP addresses as outlined in the vendor advisory. Microsoft recommends urgent patching and monitoring to prevent rapid exploitation by Storm-1175. No other mitigation actions are specified by the vendor advisory.
Technical Details
- Classification
- {"confidence":0.76,"severitySource":"heuristic","classifier":"rss-v2"}
Threat ID: 6a7a1445bf8831d5394a7804
Added to database: 08/10/2026, 18:11:17 UTC
Last enriched: 08/10/2026, 18:11:41 UTC
Last updated: 08/10/2026, 19:41:28 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.