China-Linked Storm-1175 Deploys StormEncryptor Ransomware via Critical N-central Flaw

Microsoft Threat Intelligence has disclosed that Storm-1175, a financially motivated China-linked threat actor, has abandoned the Medusa ransomware-as-a-service model in favor of deploying a previously undocumented ransomware strain: StormEncryptor. The campaign exploits CVE-2026-18577, a critical authentication bypass in N-able's N-central remote monitoring and management (RMM) platform used by thousands of managed service providers (MSPs) worldwide.

The combination of a freshly built ransomware variant and a supply-chain entry point through MSP tooling creates a cascading risk: a single compromised N-central console can push ransomware to hundreds of downstream client organizations simultaneously.

Threat Actor Profile: Storm-1175

Storm-1175 is a financially motivated threat actor with a China nexus, tracked by Microsoft as previously operating as a Medusa ransomware affiliate. The group has a history of exploiting zero-day and n-day vulnerabilities in enterprise software to achieve initial access, with a portfolio of prior targets including:

• GoAnywhere MFT and Fortra GoAnywhere (CVE-2025-10035)
• Ivanti Connect Secure
• JetBrains TeamCity
• Mirth Connect (CVE-2023-43208)
• ConnectWise ScreenConnect (CVE-2024-1709/1708)
• Fortinet FortiClient EMS (CVE-2023-48788)
• Microsoft Exchange

After going quiet in April 2026, the group re-emerged on August 2, 2026 — the same day CVE-2026-18577 was publicly disclosed — with a new ransomware payload and freshly registered extortion infrastructure.

The Vulnerability: CVE-2026-18577

CVE-2026-18577 is an authentication bypass and account takeover vulnerability in N-able N-central, a widely deployed RMM console that gives MSPs centralized management of all their clients' endpoints.

The vulnerability is assessed as a patch bypass for the earlier CVE-2026-18556, suggesting N-able's initial remediation was incomplete. CISA added both CVEs to its Known Exploited Vulnerabilities catalog on August 3, one day after disclosure — a strong signal of active exploitation confirmed in the wild.

StormEncryptor: Technical Details

StormEncryptor is a newly developed ransomware strain written in C++, representing Storm-1175's deliberate shift from using affiliate infrastructure to owning their own toolchain.

Key characteristics:

• File extension: .encrypted appended to all encrypted files
• Ransom note: !!!README_FIRST!!!.txt dropped in every directory
• Victim deadline: Three-day window to contact attackers for negotiation
• Extortion model: Double extortion — stolen data threatened for publication if ransom is unpaid
• Microsoft Defender detection: Ransom:Win64/StormEncryptor

Attack Chain

Storm-1175's campaign follows a consistent intrusion pattern once N-central access is obtained:

1. Exploit CVE-2026-18577 in N-central → Authentication bypass → Account takeover
2. Abuse legitimate RMM tools: AnyDesk or SimpleHelp for persistence
3. Network discovery: Advanced IP Scanner for lateral movement planning
4. Credential harvesting: Mimikatz / LSASS dumping
5. Rapid data exfiltration (often within days of initial access)
6. StormEncryptor ransomware deployment across managed endpoints

The use of legitimate remote management tools (AnyDesk, SimpleHelp) alongside the already-trusted N-central platform makes detection particularly challenging — these tools are expected to be present in MSP environments.

Affected Sectors and Geographies

Microsoft's disclosure identified victim organizations across multiple industries and regions:

Multiple victim organizations were listed on Storm-1175's newly launched extortion site within the first week of the campaign's public disclosure.

Compromise Indicators

Organizations and MSPs should hunt for the following indicators of compromise:

• _svchost.exe appearing in user Documents folders (anomalous — legitimate svchost runs from System32)
• A Windows service registered under the name Cloudflared that was not deliberately installed
• Inbound connections from IP addresses listed in N-able's security advisory
• Unexpected use of AnyDesk or SimpleHelp in environments where they were not provisioned
• Advanced IP Scanner execution from non-admin workstations
• LSASS memory access events indicative of credential dumping (Mimikatz signatures)

Immediate Actions Required

For MSPs running N-central:

1. Apply N-central hotfix 2026.3 HF1 (build 2026.3.1.7) immediately — do not wait for a scheduled maintenance window
2. Audit N-central for unauthorized administrator accounts — Storm-1175 creates persistence accounts post-compromise
3. Review recent N-central session logs for authentication events from unexpected IP ranges
4. Restrict N-central access to known management IPs via firewall or VPN if not already enforced

For all organizations:

• Verify no _svchost.exe files exist outside System32
• Hunt for unexpected Cloudflared service registrations
• Treat any AnyDesk or SimpleHelp sessions not initiated by your own staff as suspicious

Why MSP Supply Chains Are High-Value Targets

N-central manages endpoints across an MSP's entire client base from a single console. For Storm-1175, a single successful exploitation of one MSP's N-central server can translate into ransomware deployed across dozens or hundreds of downstream organizations simultaneously — dramatically amplifying return on investment for the initial access effort.

This mirrors the tactics used in the Kaseya VSA supply-chain attack of 2021, where a single RMM platform compromise cascaded to approximately 1,500 organizations. MSPs and their clients should treat RMM platform vulnerabilities as critical infrastructure threats, not routine software patches.

References

• Microsoft Threat Intelligence Blog
• N-able Security Advisory — CVE-2026-18577
• CISA Known Exploited Vulnerabilities Catalog
• The Hacker News Coverage