[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVRnLxgS47ZDc9moQ8L4eMIRZu2dO1vdUpcbWXIjJM4A":3,"$fZ2PTObGlb80hceiwi-dykJSNRjkw3xVuc1omgC8bTBo":99},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":15,"hero_image_url":16,"structured":17,"story_type":96,"created_at":97,"updated_at":98,"published_at":40},"storm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass","Storm-1175 deploys new StormEncryptor ransomware via N-central NCM auth bypass","China-based actor shifts from Medusa to a C++-based locker, exploiting CVE-2026-18577 in N-central NCM for initial access.","Microsoft Threat Intelligence identifies a new StormEncryptor ransomware strain deployed by the China-based Storm-1175 actor, which uses CVE-2026-18577 in N-central NCM for initial access and moves from compromise to encryption within days.",[10,11,12,13,14],"StormEncryptor","Storm-1175","N-central NCM","CVE-2026-18577","Medusa","# Storm-1175 deploys new StormEncryptor ransomware via N-central NCM auth bypass\n\n*China-based actor shifts from Medusa to a C++-based locker, exploiting CVE-2026-18577 in N-central NCM for initial access.*\n\n**Tags:** `StormEncryptor` `Storm-1175` `N-central NCM` `CVE-2026-18577` `Medusa`\n\n> Microsoft Threat Intelligence identifies a new StormEncryptor ransomware strain deployed by the China-based Storm-1175 actor, which uses CVE-2026-18577 in N-central NCM for initial access and moves from compromise to encryption within days.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-18577 | — | 14.6% | ✅ listed | — | 72.91 (High) |\n\n## New StormEncryptor ransomware strain\n\nMicrosoft Threat Intelligence has identified a new ransomware strain, StormEncryptor, deployed by the financially motivated threat actor Storm-1175. The C++-based payload appends the `.encrypted` extension to targeted files and drops a ransom note named `!!!README_FIRST!!!.txt` in every scanned directory.\n\nThe activity marks Storm-1175’s first observed operation since April 2026, representing a shift from the Medusa ransomware variant the group had previously used. Microsoft says the attacks were likely preceded by exploitation of CVE-2026-18577, an authentication-bypass vulnerability in N-central RMM that allows account takeover in versions through 2026.3.1.\n\n“Storm-1175’s deployment of StormEncryptor marks the threat actor’s first activity observed by Microsoft Threat Intelligence since April 2026, and a shift away from Medusa ransomware,” Microsoft said. “This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days.”\n\n## Initial access via CVE-2026-18577\n\nStorm-1175 gains initial access by exploiting CVE-2026-18577, an authentication-bypass vulnerability in N-central NCM that allows account takeover in versions through 2026.3.1. NVD describes the flaw as an incomplete patch for CVE-2026-18556, which the group likely weaponized immediately after N-able’s public disclosure.\n\nN-able shipped hotfix 2026.3 HF1 (build 2026.3.1.7) on August 2, 2026, the same day Microsoft first observed the StormEncryptor deployment. The CVE carries a CVSS score of ? and an EPSS probability of 14.6% (97th percentile), placing it in the high-exploitability tier. CISA added it to the Known Exploited Vulnerabilities catalog on August 3, and the PRS risk score of 72.91 rates it as High. No public PoC has been released as of this report.\n\n## Post-compromise tooling\n\nOnce inside, Storm-1175 runs a compact post-compromise stack to expand access, enumerate the network, and pull credentials before encryption begins. The group drops either AnyDesk or SimpleHelp for remote management, giving it a persistent RMM foothold across the compromised environment. Advanced IP Scanner handles network discovery, enumerating hosts and open ports within the target subnet. For credential theft, the actor uses Mimikatz to dump LSASS memory, extracting plaintext passwords and authentication material from the Windows Local Security Authority Subsystem Service process.\n\nMicrosoft says the tooling sequence is consistent with the group’s established pattern: remote access first, then network sweep, then LSASS dump, followed by data exfiltration and the StormEncryptor payload. The entire chain typically executes within a few days of initial access, which is why the group can move from the N-central RMM foothold to full encryption and the `!!!README_FIRST!!!.txt` note in a single operational window.\n\n## Who is Storm-1175\n\nStorm-1175 is a China-based, financially motivated threat actor that Microsoft Threat Intelligence has been tracking since April 2026. The group previously operated under the Medusa ransomware banner and is now deploying a new C++-based payload it calls StormEncryptor.\n\nThe actor targets internet-facing and self-hosted infrastructure, weaponizing zero-day and n-day flaws in GoAnywhere MFT, SmarterMail, Microsoft Exchange, Invanti Connect Secure, and JetBrains TeamCity. Its operational pattern is high-velocity: it moves from initial access to data exfiltration and ransomware deployment within a few days, often before organizations have applied the vendor patch.\n\n## Victims and impact\n\nVictims span e-commerce, fintech, healthcare, and home security, with a steady stream of companies appearing on Storm-1175’s ransom site over the past week. The group’s ransom note, `!!!README_FIRST!!!.txt`, threatens to publish stolen data if payment demands are not met within three days.\n\nN-able first detected active exploitation of CVE-2026-18577 on July 31, 2026, and shipped hotfix 2026.3 HF1 (build 2026.3.1.7) on August 2. CISA added the CVE to its Known Exploited Vulnerabilities catalog on August 3, 2026, confirming the rapid weaponization pattern typical of the group.\n\n## Key points\n\n- Storm-1175 is a China-based, financially motivated actor previously linked to Medusa ransomware, now deploying a new C++-based StormEncryptor strain.\n- Initial access is via CVE-2026-18577, an authentication-bypass flaw in N-central NCM (N-able), disclosed August 2, 2026 and added to CSA KEV on August 3.\n- Post-exploitation stack includes AnyDesk or SimpleHelp for RMM, Advanced IP Scanner for network discovery, and Mimikatz for LSASS credential dumping.\n- StormEncryptor appends .encrypted to files and drops a !!!README_FIRST!!!.txt ransom note in every scanned directory.\n- N-able shipped a hotfix (2026.3 HF1\u002Fbuild 2026.3.1.7) on August 2; a second hotfix followed on August 12 to block a related attack path.\n\n## Further reading & sources\n\n- [New StormEncryptor ransomware used by former Medusa affiliate](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-stormencryptor-ransomware-used-by-former-medusa-affiliate\u002F)\n- [N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577 - Help Net Security](https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F08\u002F10\u002Fcve-2026-18577-n-central-hotfix-2-msps\u002F)\n- [Storm-1175 Launches StormEncryptor Ransomware Attacks Using N-able Security Flaw](https:\u002F\u002Fgbhackers.com\u002Fstorm-1175-launches-stormencryptor-ransomware-attacks)\n- [H1 2026 Malware Vulnerability Trends](https:\u002F\u002Fwww.recordedfuture.com\u002Fresearch\u002Fh1-2026-malware-vulnerability-trends)\n- [China-Linked Hackers Use N-able Flaw in Ransomware Attacks](https:\u002F\u002Fwww.bankinfosecurity.com\u002Fchina-linked-hackers-exploit-n-able-flaw-in-ransomware-attacks-a-32506)\n- [StormEncryptor: Neue Ransomware nutzt N-able-Lücke CVE-2026-18577](https:\u002F\u002Fwww.ad-hoc-news.de\u002Fwissenschaft\u002Fstormencryptor-neue-ransomware-nutzt-n-able-luecke-cve-2026-18577\u002F69930979)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstorm-1175-deploys-new-stormencryptor-ransomware-via-n-central-ncm-auth-bypass.png?v=316922394f",{"cves":18,"actors":34,"malware":41,"targets":52,"timeline":57,"industries":77,"technologies":86},[19,29],{"id":20,"kev":21,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2026-18556",true,false,"\u002Fvulnerabilities\u002FCVE-2026-18556",7.4,0.0788,"High",74.41,"3.1",{"id":13,"kev":21,"poc":22,"url":30,"cvss":31,"epss":32,"risk_band":26,"risk_score":33,"cvss_version":28},"\u002Fvulnerabilities\u002FCVE-2026-18577",8.1,0.1462,74.08,[35],{"url":36,"name":37,"slug":38,"type":39,"origin":40,"motivation":40},"\u002Fthreat-groups\u002Fstorm","Storm","storm","ransomware",null,[42,44,46,48,49,51],{"name":43},"AnyDesk",{"name":45},"Mimikatz",{"name":47},"SimpleHelp",{"name":14},{"name":50},"Advanced IP Scanner",{"name":10},[53],{"name":54,"sector":55,"status":56,"geography":40},"N-able","IT Services","confirmed",[58,62,66,70,73],{"date":59,"event":60,"description":61},"2026-07-31","Detection","N-able’s Adlumin MDR solution detected unusual activity within a customer’s environment, leading to the discovery of a threat actor actively exploiting a zero-day vulnerability in an N-central server.",{"date":63,"event":64,"description":65},"2026-08-01","Exploitation","First detection of exploitation of CVE-2026-18577",{"date":67,"event":68,"description":69},"2026-08-02","Campaign start","StormEncryptor deployment begins",{"date":67,"event":71,"description":72},"Advisory published","N-able published security advisory for CVE-2026-18577",{"date":74,"event":75,"description":76},"2026-08-10","Hotfix","N-able released second security hotfix for N-central",[78,82],{"url":79,"name":80,"slug":81},"\u002Findustries\u002Finformation-technology-services","Information Technology Services","information-technology-services",{"url":83,"name":84,"slug":85},"\u002Findustries\u002Ftechnology","Technology","technology",[87,89,91,94],{"vendor":54,"product":88},"N-central",{"vendor":54,"product":90},"N-central RMM",{"vendor":92,"product":93},"GoAnywhere","GoAnywhere MFT",{"vendor":54,"product":95},"N-able products","ransomware_incident","2026-09-26T07:12:34.821288+00:00","2026-10-16T12:28:06.746449+00:00",{"articles":100},[101,111,123,135],{"slug":102,"title":103,"summary":104,"tags":105,"hero_image_url":109,"story_type":96,"created_at":110},"stormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577","StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577","A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.",[106,13,10,107,108],"N-able N-central","Ransomware","MSP","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstormencryptor-ransomware-deployed-via-n-central-auth-bypass-cve-2026-18577.png?v=80dc7c8067","2026-09-24T07:05:56.501709+00:00",{"slug":112,"title":113,"summary":114,"tags":115,"hero_image_url":121,"story_type":96,"created_at":122},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.",[39,116,117,118,119,120],"PetitPotam","NTLM relay","ProxyShell","LockFile","CVE-2021-36942","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","2026-09-26T07:06:42.867972+00:00",{"slug":124,"title":125,"summary":126,"tags":127,"hero_image_url":133,"story_type":96,"created_at":134},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.",[128,129,130,131,132,39],"Silent Ransom Group","Troutman Pepper Locke","law firm","data leak","SSN","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":136,"title":137,"summary":138,"tags":139,"hero_image_url":144,"story_type":96,"created_at":145},"dark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys","Dark Project ransomware group hits Brainhunter Companies LLC and Brainhunter Systems Ltd.","Dark Project, a ransomware group first seen in April 2026, has published Brainhunter Companies LLC and Brainhunter Systems Ltd. as its latest victims, bringing its total to 19 known targets with 9 active extortion links on ransomware.live.",[140,141,39,142,143],"Dark Project","Brainhunter","double extortion","ransomware.live","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fdark-project-ransomware-group-hits-brainhunter-companies-llc-and-brainhunter-sys.png?v=d6c0e0a4ac","2026-09-21T07:02:16.98855+00:00"]