Microsoft Reports Storm-1175 Using StormEncryptor in Possible N-able Flaw Exploitation
Summary
Microsoft reports that Storm-1175 is deploying StormEncryptor, which appends .encrypted to files. Exploitation of N-able CVE-2026-18577 is suspected but unconfirmed; Microsoft recommends patching and monitoring for associated tools.
Key points
- Microsoft reports Storm-1175 began deploying the previously undocumented StormEncryptor on August 2, 2026, its first observed operation since April.
- StormEncryptor appends the .encrypted extension and places !!!README_FIRST!!!.txt ransom notes in scanned directories.
- Microsoft has not confirmed the initial-access method; activity timing suggests possible exploitation of CVE-2026-18577, an authentication-bypass flaw affecting N-able products.
- Microsoft reports use of AnyDesk or SimpleHelp for remote access, Advanced IP Scanner for host discovery, and Mimikatz for LSASS memory access.
- Microsoft Defender Antivirus detects the sample as Ransom:Win64/StormEncryptor; Defender for Endpoint may alert on hands-on-keyboard activity and suspected human-operated attacks.
- Microsoft advises applying N-able security updates and investigating suspicious use of the named tools, LSASS access, and ransom-note files; isolate suspected compromised systems.
Article Details
- Event Type
- Ransomware campaign with possible exploitation of an authentication-bypass vulnerability
- Impact
- StormEncryptor encrypts victims’ files, appends the .encrypted extension, and drops ransom notes. The campaign may involve data theft and threats to publish stolen data. Microsoft has not confirmed the initial-access vulnerability; it assesses that Storm-1175 may be exploiting CVE-2026-18577 in N-able products.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | c19ded65e822bb43ad0381c58abf33b7c8890f7bcc7125058a0c849c7e1a6054 | SHA-256 hash of a StormEncryptor sample detected by Microsoft Defender Antivirus. |
MITRE ATT&CK
T1003.001 · LSASS MemoryStorm-1175 was linked to dumping LSASS memory with Mimikatz to obtain credentials and authentication material.T1018 · Remote System DiscoveryStorm-1175 reportedly used Advanced IP Scanner to enumerate hosts and discover systems on target networks.T1219 · Remote Access ToolsStorm-1175 reportedly used AnyDesk or SimpleHelp to establish or maintain remote access in compromised environments.T1486 · Data Encrypted for ImpactStormEncryptor encrypts victims’ files and appends the .encrypted extension.
CVE
Threat Actors
Malware
MedusaThe group was previously associated with Medusa ransomware deployments but is now using a custom C++-based payload designed to encrypt victims’ files and disrupt business operations.StormEncryptorhas identified a new ransomware campaign by Storm-1175 deploying the previously undocumented StormEncryptor strain, which appends the .encrypted extension and drops !!!README_FIRST!!!.txt ransom notes.
Vendors
MicrosoftMicrosoft Threat Intelligence has identified a new ransomware campaign by Storm-1175 deploying the previously undocumented StormEncryptor strain, which appends the .encrypted extension and drops !!!README_FIRST!!!.txtN-ableThe activity may be linked to exploitation of CVE-2026-18577 in N-able products, with the attackers using tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz to expand access and prepare for encryption.
Products
Microsoft Defender AntivirusMicrosoft Defender Antivirus detects the StormEncryptor sample with SHA-256 hash c19ded65e822bb43ad0381c58abf33b7c8890f7bcc7125058a0c849c7e1a6054 as Ransom:Win64/StormEncryptor.Microsoft Defender for EndpointMicrosoft Defender for Endpoint can also generate alerts associated with the operation, including “Hands-on-keyboard attack involving multiple devices” and “Potential human-operated malicious activity.”
Tools
Advanced IP ScannerThe activity may be linked to exploitation of CVE-2026-18577 in N-able products, with the attackers using tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz to expand access and prepare for encryption.AnyDeskThe activity may be linked to exploitation of CVE-2026-18577 in N-able products, with the attackers using tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz to expand access and prepare for encryption.MimikatzThe activity may be linked to exploitation of CVE-2026-18577 in N-able products, with the attackers using tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz to expand access and prepare for encryption.SimpleHelpThe activity may be linked to exploitation of CVE-2026-18577 in N-able products, with the attackers using tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz to expand access and prepare for encryption.