New StormEncryptor ransomware used by former Medusa affiliate

Summary

A former Medusa ransomware affiliate, tracked as Storm-1175, has launched a new ransomware strain called StormEncryptor. Attacks likely exploit an authentication-bypass vulnerability in the N-central RMM tool, with the actor believed to be China-based. StormEncryptor encrypts files, drops a ransom note, and exfiltrates data before deployment, moving rapidly from compromise to encryption.

Full text

New StormEncryptor ransomware used by former Medusa affiliate By Bill Toulas August 10, 2026 01:42 PM 0 A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. Microsoft Threat Intelligence is tracking the actor as Storm-1175 and says the recent attacks were likely preceded by exploitation of an authentication-bypass vulnerability (CVE-2026-18577) in the N-central remote monitoring and management (RMM) tool. Storm-1175 is believed to be a China-based threat actor. It was previously linked to Medusa ransomware, targeting systems via zero-day and n-day flaws in various products, including GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Invanti Connect Secure, and JetBrains TeamCity. “Storm-1175’s deployment of StormEncryptor marks the threat actor’s first activity observed by Microsoft Threat Intelligence since April 2026, and a shift away from Medusa ransomware, which the threat actor had previously been known to use,” Microsoft states. The researchers found that StormEncryptor is a C++ malware that appends encrypted files with the “.encrypted” filename extension and drops a ransom note named ‘!!!README_FIRST!!!.txt’ into every scanned directory. The ransom note gives victims three days to reach out to the attacker and negotiate a ransom payment. Alternatively, the stolen data would be leaked online. StormEncryptor ransom noteSource: Microsoft After gaining access to the target network, the attacker used AnyDesk or SimpleHelp for remote management, Advanced IP Scanner for network discovery, and the Mimikatz tool to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. Microsoft says that Storm-1175 moves quickly from initial compromise to stealing data and deploying the locker, urging system administrators managing self-hosted N-central servers to take immediate action to secure the systems. “This threat actor is known to rapidly move from initial access to data exfiltration and ransomware deployment, often within a few days,” warned Microsoft. “Organizations are urged to monitor for Storm-1175 activity and apply security patches as soon as possible.” N-able addressed the CVE-2026-18577 vulnerability via a hotfix (2026.3 HF1/build 2026.3.1.7) released on August 2, urging customers to install the patch immediately. N-able previously recommended admins to check for signs of compromise such as an svchost.exe file in the Documents folders of users' device, a registered service named Cloudflared, and inbound connections from the IP addresses listed in the advisory. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: CISA: SonicWall SMA1000 flaws now exploited by ransomware gangsDoppelPaymer ransomware hits Newcastle University, leaks dataRansom Cartel ransomware creator sentenced to 16 years in prisonMicrosoft Teams vishing attacks lead to Chaos ransomware attacksWest Pharmaceutical says hackers stole data, encrypted systems

Indicators of Compromise

• cve — CVE-2026-18577
• malware — StormEncryptor
• malware — Medusa
• mitre_attack — T1003

Entities