The StormEncryptor ransomware is a newly observed malware strain deployed by the threat actor Storm-1175, who was previously associated with the Medusa ransomware group. Microsoft Threat Intelligence links recent attacks to exploitation of CVE-2026-18577, an authentication-bypass vulnerability in the N-central RMM tool. Storm-1175 is believed to be China-based and has a history of exploiting zero-day and known vulnerabilities in various enterprise products. After initial access via the N-central vulnerability, the attacker uses AnyDesk or SimpleHelp for remote control, Advanced IP Scanner for network discovery, and Mimikatz to extract credentials from LSASS. The ransomware encrypts files with a .encrypted extension and drops a ransom note demanding negotiation within three days or data leakage. N-able released a hotfix (2026.3 HF1/build 2026.3.1.7) on August 2, 2026, to address the vulnerability. Microsoft warns that the threat actor moves rapidly from initial compromise to data theft and ransomware deployment, urging immediate patching and monitoring.

The threat actor Storm-1175 can gain unauthorized access to networks by exploiting an authentication-bypass vulnerability in N-central RMM software, enabling remote control and credential theft. This leads to rapid data exfiltration and deployment of StormEncryptor ransomware, which encrypts files and threatens data leakage if ransom demands are not met within three days. The attack compromises confidentiality and availability of data and disrupts normal operations of affected organizations.

A hotfix addressing CVE-2026-18577 was released by N-able on August 2, 2026 (version 2026.3 HF1/build 2026.3.1.7). Organizations using self-hosted N-central servers should apply this patch immediately. Additionally, administrators should monitor for indicators of compromise such as svchost.exe files in user Documents folders, a registered service named Cloudflared, and inbound connections from known malicious IP addresses as outlined in the vendor advisory. Microsoft recommends urgent patching and monitoring to prevent rapid exploitation by Storm-1175. No other mitigation actions are specified by the vendor advisory.