Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-18577 | — | 14.6% | ✅ listed | — | 72.91 (High) |
New StormEncryptor ransomware strain
Microsoft Threat Intelligence has identified a new ransomware strain, StormEncryptor, deployed by the financially motivated threat actor Storm-1175. The C++-based payload appends the .encrypted extension to targeted files and drops a ransom note named !!!README_FIRST!!!.txt in every scanned directory.
The activity marks Storm-1175’s first observed operation since April 2026, representing a shift from the Medusa ransomware variant the group had previously used. Microsoft says the attacks were likely preceded by exploitation of CVE-2026-18577, an authentication-bypass vulnerability in N-central RMM that allows account takeover in versions through 2026.3.1.
“Storm-1175’s deployment of StormEncryptor marks the threat actor’s first activity observed by Microsoft Threat Intelligence since April 2026, and a shift away from Medusa ransomware,” Microsoft said. “This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days.”
Initial access via CVE-2026-18577
Storm-1175 gains initial access by exploiting CVE-2026-18577, an authentication-bypass vulnerability in N-central NCM that allows account takeover in versions through 2026.3.1. NVD describes the flaw as an incomplete patch for CVE-2026-18556, which the group likely weaponized immediately after N-able’s public disclosure.
N-able shipped hotfix 2026.3 HF1 (build 2026.3.1.7) on August 2, 2026, the same day Microsoft first observed the StormEncryptor deployment. The CVE carries a CVSS score of ? and an EPSS probability of 14.6% (97th percentile), placing it in the high-exploitability tier. CISA added it to the Known Exploited Vulnerabilities catalog on August 3, and the PRS risk score of 72.91 rates it as High. No public PoC has been released as of this report.
Post-compromise tooling
Once inside, Storm-1175 runs a compact post-compromise stack to expand access, enumerate the network, and pull credentials before encryption begins. The group drops either AnyDesk or SimpleHelp for remote management, giving it a persistent RMM foothold across the compromised environment. Advanced IP Scanner handles network discovery, enumerating hosts and open ports within the target subnet. For credential theft, the actor uses Mimikatz to dump LSASS memory, extracting plaintext passwords and authentication material from the Windows Local Security Authority Subsystem Service process.
Microsoft says the tooling sequence is consistent with the group’s established pattern: remote access first, then network sweep, then LSASS dump, followed by data exfiltration and the StormEncryptor payload. The entire chain typically executes within a few days of initial access, which is why the group can move from the N-central RMM foothold to full encryption and the !!!README_FIRST!!!.txt note in a single operational window.
Who is Storm-1175
Storm-1175 is a China-based, financially motivated threat actor that Microsoft Threat Intelligence has been tracking since April 2026. The group previously operated under the Medusa ransomware banner and is now deploying a new C++-based payload it calls StormEncryptor.
The actor targets internet-facing and self-hosted infrastructure, weaponizing zero-day and n-day flaws in GoAnywhere MFT, SmarterMail, Microsoft Exchange, Invanti Connect Secure, and JetBrains TeamCity. Its operational pattern is high-velocity: it moves from initial access to data exfiltration and ransomware deployment within a few days, often before organizations have applied the vendor patch.
Victims and impact
Victims span e-commerce, fintech, healthcare, and home security, with a steady stream of companies appearing on Storm-1175’s ransom site over the past week. The group’s ransom note, !!!README_FIRST!!!.txt, threatens to publish stolen data if payment demands are not met within three days.
N-able first detected active exploitation of CVE-2026-18577 on July 31, 2026, and shipped hotfix 2026.3 HF1 (build 2026.3.1.7) on August 2. CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 3, 2026, confirming the rapid weaponization pattern typical of the group.
Key points
- Storm-1175 is a China-based, financially motivated actor previously linked to Medusa ransomware, now deploying a new C++-based StormEncryptor strain.
- Initial access is via CVE-2026-18577, an authentication-bypass flaw in N-central NCM (N-able), disclosed August 2, 2026 and added to CSA KEV on August 3.
- Post-exploitation stack includes AnyDesk or SimpleHelp for RMM, Advanced IP Scanner for network discovery, and Mimikatz for LSASS credential dumping.
- StormEncryptor appends .encrypted to files and drops a !!!README_FIRST!!!.txt ransom note in every scanned directory.
- N-able shipped a hotfix (2026.3 HF1/build 2026.3.1.7) on August 2; a second hotfix followed on August 12 to block a related attack path.
Further reading & sources
- New StormEncryptor ransomware used by former Medusa affiliate
- N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577 - Help Net Security
- Storm-1175 Launches StormEncryptor Ransomware Attacks Using N-able Security Flaw
- H1 2026 Malware Vulnerability Trends
- China-Linked Hackers Use N-able Flaw in Ransomware Attacks
- StormEncryptor: Neue Ransomware nutzt N-able-Lücke CVE-2026-18577