Old Medusa Hand, New Locker: Storm-1175 Rolls Out StormEncryptor via N-central Flaw

Key points

• Microsoft Threat Intelligence has tied a new ransomware strain called StormEncryptor to a China-based group it tracks as Storm-1175, previously an affiliate of the Medusa ransomware gang.
• The attackers are breaking in through CVE-2026-18577, an authentication-bypass flaw in N-able's N-central remote monitoring tool.
• N-able shipped a hotfix, build 2026.3.1.7, on 2 August and is telling customers to install it immediately.
• StormEncryptor is written in C++, adds an ".encrypted" extension to locked files, and drops a ransom note giving victims three days before stolen data is leaked.
• Storm-1175 often goes from first break-in to stealing files and locking systems within a matter of days.

A hacking crew that used to work with the Medusa ransomware gang has switched to a brand-new locker, and it's getting in through a serious flaw in software that IT teams use to run other people's computers.

Microsoft calls the group Storm-1175 and believes it operates out of China. First reported by BleepingComputer, the shift marks the group's first known activity since April 2026 and a clean break from Medusa, the ransomware strain it had leaned on for years.

The new tool is called StormEncryptor. It's ransomware, meaning malicious software that scrambles a company's files and demands payment to unscramble them. Victims get a note dropped into every folder the malware touches, warning them they've got three days to negotiate or their stolen data will be published online.

How are the hackers getting in?

They're exploiting a flaw in N-able's N-central, a remote monitoring tool that IT providers use to manage client networks from a single console. The bug, tracked as CVE-2026-18577, is an authentication-bypass vulnerability: it lets an attacker walk past the login screen without valid credentials. We've covered this bug since it surfaced, starting with N-able's own confirmation on 3 August that the platform's first patch hadn't held.

N-able pushed a fix on 2 August, build 2026.3.1.7, and told customers to install it straight away. Anyone still running an unpatched, self-hosted N-central server is exposed.

Multi-factor authentication wouldn't have saved anyone here. Authentication-bypass bugs skip the whole login flow, so the second factor never gets asked for. Patching is the only real answer.

What happens after they break in?

Storm-1175 moves fast. Microsoft says the group often goes from initial access to data theft and file encryption inside a few days.

Once inside, the attackers install AnyDesk or SimpleHelp, both legitimate remote-control tools, so they can return whenever they like. Advanced IP Scanner maps the network. Then Mimikatz, a credential-dumping tool, pulls passwords out of a Windows process called LSASS that holds them in memory.

StormEncryptor itself is written in C++ and tags every locked file with an ".encrypted" ending.

Has this group done this before?

Yes, and against a long list of recognisable products. Storm-1175 targets internet-facing enterprise software using zero-day flaws (bugs the vendor didn't know about) and n-day flaws (patched bugs not yet installed everywhere).

Past targets include GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Ivanti Connect Secure, and JetBrains TeamCity. The pattern's consistent: find a product sitting on the edge of a corporate network, exploit it, then pivot inward. A former Medusa affiliate that followed the same playbook, building its own toolkit rather than renting one, turned up in our reporting back in June.

What should IT teams check right now?

Patch first. Then hunt for the clues N-able has already flagged: an svchost.exe file sitting inside a user's Documents folder (it should never be there), a Windows service registered under the name Cloudflared, and inbound connections from the IP addresses in N-able's advisory.

If any of those show up, treat the box as compromised and start incident response. Storm-1175 doesn't sit quietly, so if they got in last week, encryption may already be scheduled.