Storm-1175 Debuts New Ransomware

Microsoft has lifted the lid on a new ransomware strain called StormEncryptor, deployed by a China-linked threat actor that has historically leaned on Medusa ransomware. The disclosure points to a likely entry point in N-able's N-central platform, and it signals a tactical shift that could complicate defense efforts for organizations already tracking this adversary.

Storm-1175's Ransomware Evolution

Microsoft's Threat Intelligence Team says the financially motivated group, tracked as Storm-1175, has moved away from its previous reliance on Medusa ransomware. The new tool, StormEncryptor, is written in C++ and appends the file name extension .encrypted to files it encrypts, according to Microsoft's posts on Bluesky.

After encrypting, the malware drops a ransom note named !!!README_FIRST!!!.txt to every scanned directory. The exact mechanics of the encryption routine beyond the file extension and note drop have not been detailed, but the strain represents a notable departure from the group's established playbook.

N-central Flaw Likely Entry Point

Microsoft says the exact vulnerability exploited in this campaign is unclear, but it likely involves CVE-2026-18577, a newly disclosed security flaw in N-able N-central. The tech giant assesses this flaw as a patch bypass for CVE-2026-18556, with both allowing authentication bypass and account takeover in susceptible versions.

The vulnerabilities have since been flagged by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as actively exploited in the wild. That designation typically signals a high level of urgency for organizations running the affected software, since attackers may already be probing or leveraging the flaws.

A History of Exploiting Known Flaws

Storm-1175's track record shows a preference for turning known vulnerabilities into entry points. The group has previously exploited security flaws in Mirth Connect (CVE-2023-37679, CVE-2023-43208), ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708), JetBrains TeamCity (CVE-2024-27198, CVE-2024-27199), and Fortinet FortiClient EMS (CVE-2023-48788).

In an analysis published in October 2025, Microsoft also attributed the threat actor to the exploitation of a critical security vulnerability impacting Fortra GoAnywhere (CVE-2025-10035) to facilitate the deployment of Medusa ransomware. That history underscores a pattern of using public-facing systems as initial access points.

High-Velocity Attack Tactics

According to Microsoft, the group weaponizes a combination of zero-days and N-day vulnerabilities to carry out high-velocity attacks. The goal is to break into susceptible internet-facing systems by taking advantage of the window between vulnerability disclosure and patch adoption.

In this new activity, Storm-1175's post-compromise behavior includes abuse of remote monitoring and management tools AnyDesk or SimpleHelp, Advanced IP Scanner for discovery, and LSASS dumping using Mimikatz. These tools are often used to maintain persistence, move laterally, and harvest credentials.

Rapid Escalation to Exfiltration

The timeline from initial access to data exfiltration and ransomware deployment is aggressive. Storm-1175 has been observed moving through these stages mostly within a few days, according to Microsoft. That speed leaves little room for defenders to detect and respond before the damage is done.

• Ransomware strain: StormEncryptor, written in C++
• File extension appended: .encrypted
• Ransom note name: !!!README_FIRST!!!.txt
• Likely initial access: CVE-2026-18577 (N-able N-central)
• Related flaw: CVE-2026-18556, bypassed by CVE-2026-18577
• Time from access to exfiltration/deployment: within a few days

Urgency for Patches

Given the speed of Storm-1175's operations, Microsoft emphasizes that customers should apply patches as soon as possible. The company's advisory is direct: the window between disclosure and exploitation is narrow, and delaying updates can leave systems exposed to a ransomware event.

While Microsoft did not provide specific indicators of compromise or a full technical breakdown, the disclosure is a clear warning for organizations running the affected software to prioritize patching and review their remote monitoring and management tool usage.

"StormEncryptor is written in C++ and appends the file name extension .encrypted to files it encrypts. It then drops a ransom note named !!!README_FIRST!!!.txt to every scanned directory."

— Microsoft Threat Intelligence Team, in a series of posts on Bluesky

What This Means for Defenders

The emergence of a new ransomware variant from a known threat actor raises the stakes for organizations that may have become complacent about patching N-able N-central or similar remote management tools. The fact that Storm-1175 has shifted from Medusa to StormEncryptor suggests that the group is continuously evolving its toolkit, which could make detection more challenging for security teams that have tuned their defenses to the older strain.

The rapid transition from access to data exfiltration and encryption means that traditional response times may not be sufficient. For defenders, this suggests a need for proactive measures: verify that patches for CVE-2026-18577 and CVE-2026-18556 are applied, monitor for the use of AnyDesk, SimpleHelp, or Advanced IP Scanner in unexpected contexts, and assume that any unpatched internet-facing system is a potential target.

Beyond patching, the disclosure reinforces the importance of monitoring for tools commonly used in post-exploitation, such as Mimikatz, and having a plan for isolating systems quickly if ransomware activity is suspected. This could mean the difference between a contained incident and a full-scale data exfiltration event.