cyber.hendryadrian.com
Security News · bleepingcomputer.com

Microsoft: Storm-1175 Deploys New StormEncryptor Ransomware, Likely Exploiting N-central

· Original article ↗

Summary

Microsoft says Storm-1175, previously linked to Medusa, is deploying StormEncryptor and likely exploited CVE-2026-18577 in N-central. N-able released a hotfix; the ransomware encrypts files and threatens to leak stolen data.

Key points

  • Microsoft attributes StormEncryptor deployment to Storm-1175, a financially motivated actor previously associated with Medusa ransomware.
  • Microsoft says the attacks were likely preceded by exploitation of the authentication-bypass vulnerability CVE-2026-18577 in N-central.
  • StormEncryptor appends the .encrypted extension and places a !!!README_FIRST!!!.txt ransom note in scanned directories, threatening data leaks if victims do not negotiate within three days.
  • The actor used AnyDesk or SimpleHelp for remote management, Advanced IP Scanner for network discovery, and Mimikatz to dump LSASS credentials.
  • Microsoft warns that Storm-1175 can move from initial access to data exfiltration and ransomware deployment within a few days.
  • N-able released hotfix 2026.3 HF1/build 2026.3.1.7 on August 2 and urged customers to install it.

Article Details

Event Type
Storm-1175 is reportedly using the new StormEncryptor ransomware, likely after exploiting the CVE-2026-18577 authentication-bypass vulnerability in N-central.
Impact
StormEncryptor encrypts files, appends the .encrypted extension, and threatens to leak stolen data unless victims contact the attacker within three days. Microsoft says the actor can move rapidly from initial access to data theft and ransomware deployment. N-able released hotfix 2026.3 HF1/build 2026.3.1.7 on August 2 and urged customers to install it.

MITRE ATT&CK

T1003.001 · LSASS MemoryThe actor used Mimikatz to dump credentials from the LSASS process.T1046 · Network Service DiscoveryThe actor used Advanced IP Scanner for network discovery.T1219 · Remote Access ToolsStorm-1175 used AnyDesk or SimpleHelp for remote management after gaining network access.T1486 · Data Encrypted for ImpactStormEncryptor encrypts files and appends the .encrypted extension.

CVE

CVE-2026-18577Microsoft says the threat actor Storm-1175, previously linked to Medusa ransomware, is now deploying a new ransomware strain called StormEncryptor after likely exploiting CVE-2026-18577 in N-central.

Threat Actors

Storm-1175Microsoft Threat Intelligence tracks this actor and says recent attacks were likely preceded by exploitation of CVE-2026-18577 in N-central. The actor was previously linked to Medusa ransomware and is believed to be China-based.

Malware

MedusaMicrosoft says the threat actor Storm-1175, previously linked to Medusa ransomware, is now deploying a new ransomware strain called StormEncryptor after likely exploiting CVE-2026-18577 in N-central.StormEncryptorMicrosoft says the threat actor Storm-1175, previously linked to Medusa ransomware, is now deploying a new ransomware strain called StormEncryptor after likely exploiting CVE-2026-18577 in N-central.

Vendors

N-ableN-able released hotfix 2026.3 HF1/build 2026.3.1.7 and urged immediate patching.

Products

N-centralMicrosoft says the threat actor Storm-1175, previously linked to Medusa ransomware, is now deploying a new ransomware strain called StormEncryptor after likely exploiting CVE-2026-18577 in N-central.

Tools

Advanced IP ScannerThe actor used AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz during the intrusion.AnyDeskThe actor used AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz during the intrusion.MimikatzThe actor used AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz during the intrusion.SimpleHelpThe actor used AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz during the intrusion.

Countries

ChinaStorm-1175 is believed to be a China-based threat actor.

Related Articles