Old Medusa Hand, New Locker: Storm-1175 Rolls Out StormEncryptor via N-central Flaw

Key points

• Microsoft Threat Intelligence has tied a new ransomware strain called StormEncryptor to a China-based group it tracks as Storm-1175, previously an affiliate of the Medusa ransomware gang.
• The attackers are breaking in through CVE-2026-18577, an authentication-bypass flaw in N-able's N-central remote monitoring tool.
• N-able shipped a hotfix, build 2026.3.1.7, on 2 August and is telling customers to install it immediately.
• StormEncryptor is written in C++, adds an ".encrypted" extension to locked files, and drops a note called "!!!README_FIRST!!!.txt" giving victims three days before stolen data is leaked.
• Microsoft warns Storm-1175 often goes from first break-in to stealing files and locking systems in a matter of days.

A hacking crew that used to work with the Medusa ransomware gang has switched to a brand new locker, and it is getting in through a serious flaw in software that IT teams use to run other people's computers.

Microsoft calls the group Storm-1175 and believes it operates out of China. First reported by BleepingComputer, the shift marks the group's first known activity since April 2026 and a clean break from Medusa, the ransomware strain it had leaned on for years.

The new tool is called StormEncryptor. It is ransomware, meaning malicious software that scrambles a company's files and demands payment to unscramble them. Victims get a note called "!!!README_FIRST!!!.txt" dropped into every folder the malware touches, warning them they have three days to negotiate or their stolen data will be published online.

How are the hackers getting in?

They are exploiting a flaw in N-able's N-central, a remote monitoring and management tool that IT providers use to look after client networks from a single console. The bug, tracked as CVE-2026-18577, is an authentication-bypass vulnerability. In plain English: it lets an attacker walk past the login screen without valid credentials and act as if they belong there.

N-able pushed a fix on 2 August, build 2026.3.1.7, and told customers to install it straight away. Anyone still running an unpatched, self-hosted N-central server is exposed.

Multi-factor authentication would not have saved anyone here, honestly. Authentication-bypass bugs skip the whole login flow, so the second factor never gets asked for. Patching is the only real answer.

What happens after they break in?

Storm-1175 moves fast. Microsoft says the group often goes from initial access to data theft and file encryption inside a few days.

Once inside, the attackers install AnyDesk or SimpleHelp, both legitimate remote-control tools, so they can log back in whenever they like. They run Advanced IP Scanner to map the network. They use Mimikatz, a well-known credential-dumping tool, to pull passwords out of a Windows process called LSASS that holds them in memory.

StormEncryptor itself is written in C++ and tags every file it locks with an ".encrypted" ending.

Has this group done this before?

Yes, and to a lot of well-known products. Storm-1175 has a track record of hitting internet-facing enterprise software using both zero-day flaws (bugs the vendor did not know about) and n-day flaws (bugs that are patched but not yet installed everywhere).

Past targets include GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Ivanti Connect Secure and JetBrains TeamCity. The pattern is consistent: find a product sitting on the edge of a corporate network, exploit it, then pivot inward.

What should IT teams check right now?

Patch first. Then hunt for the specific clues N-able has already flagged: an svchost.exe file sitting inside a user's Documents folder (it should never be there), a Windows service registered under the name Cloudflared, and inbound connections from the IP addresses in N-able's advisory.

If any of those show up, treat the box as compromised and start incident response. Storm-1175 does not sit quietly, so if they got in last week, the encryption may already be scheduled.