StormEncryptor: Storm-1175 Debuts New Ransomware, Likely Through the N-able N-central Zero-Day

Storm-1175, the financially motivated actor Microsoft previously tied to Medusa ransomware, has moved to a new locker called StormEncryptor. The first deployment was on 2 August 2026, the day N-able disclosed an authentication bypass in its N-central remote monitoring and management (RMM) platform. This is not a last-48-hours story: the reporting is nearly three months old. We are covering it now because N-central patching was still the open question in the sources we read, and because we found no earlier article on this site about the campaign.

Sources and limits

We opened and read: BleepingComputer (10 August 2026), BankInfoSecurity (10 August 2026), N-able’s security update (10 August 2026), CISA’s KEV alert (3 August 2026), GBHackers, Tech-Insider and Microsoft’s April 2026 Storm-1175 report.

We could not locate Microsoft’s own StormEncryptor post, so every Microsoft statement below is as quoted by BleepingComputer and BankInfoSecurity. We did not open Huntress, Rapid7 or the N-able status-page hotfix notes.

What is confirmed

• The vulnerability. N-able’s Adlumin MDR detected an attacker exploiting a previously unknown N-central flaw on 31 July. CVE-2026-18577 was registered on 2 August. CISA’s alert of 3 August lists it as an authentication bypass using an alternate path or channel. N-able says the attacker gained remote administrative access without authentication, used the Take Control feature to reach managed devices, and registered Cloudflare tunnel services for persistence.
• Fixes. Hotfix 1 (2026.3.1.7) shipped 2 August. Hotfix 2 (2026.3.1.10) shipped 6 August, supersedes it, and addresses a related attack path.
• Customer impact. N-able says a limited number of customers were affected and that it contacted each directly. It has not published a count and promises a root cause analysis later.
• The ransomware. Per BleepingComputer, Microsoft describes StormEncryptor as C++ ransomware that appends .encrypted and drops !!!README_FIRST!!!.txt in each scanned directory. The note reportedly gives victims three days to open negotiations before stolen data is leaked.
• Post-access tooling. Microsoft, as reported, observed AnyDesk or SimpleHelp, Advanced IP Scanner and Mimikatz LSASS dumping.

What is only “likely”

Microsoft’s link between Storm-1175 and N-central is probabilistic. BleepingComputer says the attacks were “likely preceded by” exploitation of CVE-2026-18577 and does not confirm it. Microsoft’s April report, which we read, mentions N-able only as one of several RMM tools the actor has used since 2023, with no N-able CVE. N-able’s blog does not name Storm-1175 or any ransomware family.

The sources also disagree on the CVE chain. BankInfoSecurity attributes to Rapid7 the claim that exploitation followed an incomplete fix for CVE-2026-18556. N-able lists CVE-2026-18556 as the first CVE in its timeline. We did not verify the relationship against Rapid7 directly. Tech-Insider states Storm-1175 used the flaw as a zero-day from 31 July. N-able confirms an unnamed actor exploited it on 31 July, but only Tech-Insider names Storm-1175 for that date, so we treat that as unconfirmed.

Attribution to China comes from Microsoft as relayed by BleepingComputer (“believes is China-based”) and BankInfoSecurity (“linked to China”). Neither explains the evidence.

Claims we could not verify

• Victims. BankInfoSecurity says victims appeared on Storm-1175’s leak site in the prior week across e-commerce, fintech, healthcare and home security. It names none. Leak-site postings are the group’s own claims and we have no victim confirmation.
• Unpatched share. Tech-Insider reports that Huntress found over 50 percent of reachable cloud-hosted and 28.6 percent of self-hosted N-central servers unpatched in mid-August. We did not open Huntress, so treat this as unverified.
• Ransomware use. The search snippet we saw says CISA lists known ransomware use as “Unknown”. The alert page we opened did not show that field.

Our assessment

This follows the pattern Microsoft documented in April: fast exploitation of internet-facing systems, often within days of disclosure and sometimes within 24 hours. An RMM server is a high-value target because one compromised console reaches every managed endpoint. If StormEncryptor is the same operators’ own locker rather than a Medusa affiliate payload, it suggests Storm-1175 no longer depends on a RaaS brand. That inference rests on one description of the malware as a new family and is not established fact.

What defenders should do

1. Confirm N-central is on 2026.3.1.10 or later. N-able advises that anyone who applied a hotfix more than a few days after release should treat the environment as potentially compromised.
2. Hunt for the N-able indicators: svchost.exe in a user’s Documents folder, a service named Cloudflared, unexpected Take Control sessions, new accounts, unexplained password resets, and traffic to the IP addresses listed in N-able’s advisory.
3. Enforce MFA on all N-central accounts and disable the in-product support account unless a case requires it.
4. Run N-able’s detection template, but note its warning that a clean result does not prove the environment was unaffected.
5. Look for unapproved AnyDesk or SimpleHelp installs and for !!!README_FIRST!!!.txt files. Microsoft’s April guidance on Credential Guard, tamper protection and attack surface reduction rules applies here too.

MSPs should also check whether any downstream customers were reachable through their N-central instance and notify them under their contracts.