Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
2 matching stories
CVE-2026-18577Storm-1175 deploys new StormEncryptor ransomware via N-central NCM auth bypass
Microsoft Threat Intelligence identifies a new StormEncryptor ransomware strain deployed by the China-based Storm-1175 actor, which uses CVE-2026-18577 in N-central NCM for initial access and moves from compromise to encryption within days.
StormEncryptor ransomware deployed via N-central auth-bypass CVE-2026-18577
A former Medusa affiliate (Storm-1175) is actively deploying StormEncryptor ransomware through an incomplete patch for CVE-2026-18556 in N-able N-central, allowing unauthenticated remote attackers to bypass authentication and take over the RMM server to reach managed endpoints.
