Full Report
Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware, the Microsoft Threat Intelligence Team said. "StormEncryptor is written in C++ and appends the file name extension .encrypted
Analysis Summary
# Morning News Roll-up August 10, 2026
## Overview
Microsoft Threat Intelligence has identified a shift in tactics from the China-linked threat actor Storm-1175, who has transitioned from Medusa ransomware to a custom, undocumented C++ strain dubbed "StormEncryptor." This actor is currently weaponizing newly disclosed vulnerabilities in remote monitoring tools to facilitate high-velocity attacks against internet-facing systems.
## Top Stories
### China-Linked Hackers Deploy New StormEncryptor Ransomware
- Summary: Storm-1175 is utilizing a new C++ based ransomware called StormEncryptor, likely gaining access through N-able N-central vulnerabilities (CVE-2026-18577). The actor moves rapidly from initial access to data exfiltration within days.
- Source: hxxps://thehackernews[.]com/2026/08/china-linked-hackers-deploy-new[.]html
### Microsoft Links Storm-1175 to GoAnywhere Exploitation
- Summary: Previous analysis attributed the exploitation of Fortra GoAnywhere (CVE-2025-10035) to Storm-1175, demonstrating the group's consistent history of targeting N-day vulnerabilities to deploy ransomware.
- Source: hxxps://thehackernews[.]com/2025/10/microsoft-links-storm-1175-to[.]html
### N-central Flaws Under Active Exploitation
- Summary: CISA has flagged CVE-2026-18577 and CVE-2026-18556 as being exploited in the wild. These authentication bypass flaws in N-able N-central serve as the primary entry point for the StormEncryptor campaign.
- Source: hxxps://thehackernews[.]com/2026/08/n-central-attackers-reach-managed[.]html
---
# Main Topic
Deployment of StormEncryptor ransomware by the China-linked, financially motivated threat actor Storm-1175, primarily targeting vulnerabilities in remote management and monitoring (RMM) software.
## Key Points
- **New Ransomware Strain:** StormEncryptor is a previously undocumented ransomware written in C++.
- **Tactical Shift:** The actor has moved away from using Medusa ransomware in favor of this proprietary tool.
- **High Velocity:** The group typically progresses from initial compromise to ransomware deployment within a few days.
- **Exploitation Focus:** The campaign leverages "patch bypass" vulnerabilities and the gap between vulnerability disclosure and patch application.
- **File Impact:** Appends the `.encrypted` extension to files and drops a ransom note titled `!!!README_FIRST!!!.txt`.
## Threat Actors
- **Storm-1175:** A China-based, financially motivated threat actor.
- **Motivation:** Financial gain through ransomware and extortion.
- **History:** Previously associated with Medusa ransomware and extensive exploitation of internet-facing software (ConnectWise, TeamCity, Fortinet).
## TTPs
- **Initial Access:** Exploitation of N-day vulnerabilities, specifically authentication bypasses in N-able N-central.
- **Discovery:** Use of **Advanced IP Scanner**.
- **Credential Access:** Dumping LSASS using **Mimikatz**.
- **Persistence/Remote Access:** Abuse of legitimate RMM tools including **AnyDesk** and **SimpleHelp**.
- **Encryption:** C++ based encryption routine appending `.encrypted` extension.
- **Data Exfiltration:** Rapid exfiltration of sensitive data prior to encryption.
## Affected Systems
- **N-able N-central:** Susceptible versions vulnerable to CVE-2026-18577 and CVE-2026-18556 (Authentication Bypass/Account Takeover).
- **Internet-facing Servers:** Systems running Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, and Fortinet FortiClient EMS that remain unpatched against historical CVEs.
- **Fortra GoAnywhere:** Specifically CVE-2025-10035.
## Mitigations
- **Patch Management:** Immediately apply updates for N-able N-central to remediate CVE-2026-18577.
- **RMM Security:** Audit and restrict the use of remote monitoring tools like AnyDesk and SimpleHelp; implement application whitelisting.
- **Endpoint Protection:** Deploy EDR solutions to detect Mimikatz activity and LSASS dumping.
- **Network Scanning:** Monitor for unauthorized use of Advanced IP Scanner within the environment.
- **Vulnerability Scanning:** Prioritize patching for all internet-facing N-day vulnerabilities mentioned in Storm-1175's history.
## Conclusion
Storm-1175 represents a high-velocity threat that specializes in weaponizing newly disclosed vulnerabilities before organizations can effectively patch. The transition to the custom StormEncryptor ransomware suggests an evolution in their toolkit aimed at evading standard detections associated with Medusa. Organizations using N-able N-central or similar RMM tools should consider themselves high-priority targets and should prioritize immediate patching and credential monitoring.