MalwarePublished 10 Aug 2026

New StormEncryptor ransomware used by former Medusa affiliate

Source Bleeping Computer

Mentions 1 CVE

Mentioned vulnerabilities

CVE-2026-18577

ransomware

Description

A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. [...]

Impact

The threat actor Storm-1175 can gain unauthorized access to networks by exploiting an authentication-bypass vulnerability in N-central RMM software, enabling remote control and credential theft. This leads to rapid data exfiltration and deployment of StormEncryptor ransomware, which encrypts files and threatens data leakage if ransom demands are not met within three days. The attack compromises confidentiality and availability of data and disrupts normal operations of affected organizations.

Defensive guidance

A hotfix addressing CVE-2026-18577 was released by N-able on August 2, 2026 (version 2026.3 HF1/build 2026.3.1.7). Organizations using self-hosted N-central servers should apply this patch immediately. Additionally, administrators should monitor for indicators of compromise such as svchost.exe files in user Documents folders, a registered service named Cloudflared, and inbound connections from known malicious IP addresses as outlined in the vendor advisory. Microsoft recommends urgent patching and monitoring to prevent rapid exploitation by Storm-1175. No other mitigation actions are specified by the vendor advisory.

References

bleepingcomputer.com/news/security/new-stormencryptor-ransomware-used-by-former-medusa-affiliate/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Aug 2026, 18:11 UTC

References

Community reviews

Related threats