Full Report
A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. [...]
Analysis Summary
# Morning News Roll-up August 10, 2026
## Overview
Today's intelligence highlights a significant shift in the ransomware landscape as a former Medusa affiliate, Storm-1175, pivots to a new proprietary strain called StormEncryptor. The campaign is characterized by the rapid exploitation of a critical N-central RMM vulnerability and swift progression from initial access to full encryption.
## Top Stories
### New StormEncryptor ransomware used by former Medusa affiliate
- Summary: A China-based threat actor (Storm-1175) has moved away from Medusa ransomware to deploy a new C++ based strain named StormEncryptor. The actor targets self-hosted N-central RMM servers using an authentication-bypass zero-day.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/new-stormencryptor-ransomware-used-by-former-medusa-affiliate/
# StormEncryptor Ransomware Campaign
Financially motivated threat actor Storm-1175 (formerly associated with Medusa ransomware) is currently deploying a new C++ ransomware strain called StormEncryptor. The campaign leverages a critical authentication-bypass vulnerability in N-able’s N-central RMM tool to gain initial access, subsequently moving to data exfiltration and encryption within a very short timeframe.
## Key Points
- **Shift in Arsenal:** This represents the first observed activity from Storm-1175 since April 2026 and marks a transition from using Medusa ransomware to the new StormEncryptor locker.
- **Speed of Attack:** The actor is noted for high velocity, often moving from initial compromise to ransomware deployment within a few days.
- **New Malware Profile:** StormEncryptor is written in C++, appends the `.encrypted` extension to files, and utilizes a time-sensitive extortion model (3-day negotiation window).
- **Exploitation of Zero-Day:** The campaign heavily relies on CVE-2026-18577, an authentication-bypass flaw in N-central RMM.
## Threat Actors
- **Storm-1175:** A China-based, financially motivated threat actor.
- **Affiliations:** Previously operated as an affiliate for the Medusa ransomware operation.
- **History:** Known for exploiting zero-day and n-day flaws in GoAnywhere MFT, SmarterMail, Microsoft Exchange, Ivanti Connect Secure, and JetBrains TeamCity.
## TTPs
- **Initial Access:** Exploitation of CVE-2026-18577 (N-central authentication bypass).
- **Reconnaissance:** Use of **Advanced IP Scanner** for network discovery.
- **Persistence/Remote Access:** Deployment of **AnyDesk**, **SimpleHelp**, and **Cloudflared** services.
- **Credential Access:** Dumping LSASS process credentials using **Mimikatz**.
- **Exfiltration:** Data theft prior to encryption to facilitate double extortion.
- **Impact:** Deployment of **StormEncryptor** ransomware via C++ executable.
## Affected Systems
- **N-able N-central:** Self-hosted remote monitoring and management servers.
- **Versions:** Vulnerable to CVE-2026-18577 (Fixed in build 2026.3.1.7).
- **Windows Environments:** General targeting of enterprise files via LSASS exploitation and network scanning.
## IoCs
- **Filenames:** `!!!README_FIRST!!!.txt` (Ransom note), `svchost.exe` (located in User Documents folders).
- **Services:** `Cloudflared` (unauthorized service registration).
- **Extensions:** `.encrypted`
- **Vulnerability:** CVE-2026-18577
## Mitigations
- **Patching:** Immediately install N-able N-central hotfix **2026.3 HF1 (build 2026.3.1.7)**.
- **Detection:** Monitor for unusual `svchost.exe` executions originating from user Document directories.
- **Credential Protection:** Implement LSASS protection (e.g., PPL) and monitor for Mimikatz-related activity or unauthorized LSASS memory dumps.
- **Remote Tool Audit:** Audit the environment for unauthorized installations of AnyDesk, SimpleHelp, or Cloudflared.
## Conclusion
Storm-1175 demonstrates a high level of technical proficiency and speed. The shift to StormEncryptor suggests a desire for greater autonomy or a change in the ransomware-as-a-service (RaaS) dynamics. Organizations utilizing N-central RMM must prioritize patching CVE-2026-18577, as the window between initial access and total environment encryption is extremely narrow.