Loading story…
Microsoft said the financially motivated, China-linked threat actor Storm-1175 is using CVE-2026-18577, a critical authentication-bypass flaw in N-able N-central, to deploy a new ransomware strain called StormEncryptor. The activity began around July 31, with Microsoft observing ransomware deployments from August 2, the same day the vulnerability was publicly disclosed. The flaw can give unauthenticated attackers full administrative control of N-central servers, raising supply-chain concerns because managed service providers use the platform to manage large numbers of downstream customer endpoints.
The campaign marks Storm-1175’s first observed activity since April and a shift from its earlier association with Medusa to a custom C++ encryptor. Microsoft observed the group using AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz for remote access, network discovery, credential theft, and hands-on-keyboard deployment. StormEncryptor appends the .encrypted extension to files and drops ransom notes named !!!README_FIRST!!!.txt. N-able released multiple emergency fixes after attackers bypassed an initial patch, CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, and Huntress warned that many internet-exposed N-central instances remained unpatched.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
On August 6, 2026, N-able issued a second emergency hotfix and warned customers that the first fix was insufficient after attackers found a way around the initial patch. The company also said it had contacted a limited number of affected customers.
CISA added CVE-2026-18577 to its Known Exploited Vulnerabilities catalog on August 3, 2026. The listing reflected active exploitation concerns around the N-able vulnerability.
N-able released an emergency hotfix on August 2, 2026 to address CVE-2026-18577 in N-central. The flaw could give unauthenticated administrative control over affected servers.
The authentication-bypass vulnerability CVE-2026-18577 affecting N-able products was publicly disclosed on August 2, 2026. Microsoft noted StormEncryptor activity was observed the same day the flaw became public.
Microsoft Threat Intelligence observed Storm-1175 begin deploying the previously undocumented StormEncryptor ransomware on August 2, 2026. Microsoft said this was the group's first observed activity since April 2026 and assessed the campaign may be tied to exploitation of CVE-2026-18577.
N-able said CVE-2026-18577 was first detected in a zero-day attack on N-central on July 31, 2026. The company said it was unclear whether Storm-1175 was responsible for that initial exploitation.
Guidance from CERT.UG and N-able described attackers using CVE-2026-18577 to take over N-central servers, pivot to managed customer endpoints through Take Control, and install persistent Cloudflare tunnels as Windows services. The notice also published endpoint indicators such as svchost.exe in user Documents folders and a Cloudflared service.
Microsoft Threat Intelligence said Storm-1175, a threat actor previously associated with Medusa ransomware, had shifted to deploying a new ransomware strain called StormEncryptor. Microsoft also assessed the actor to be China-based and published technical details on the malware and post-compromise tooling.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecysecurity.news
Open sourcecert.ug
Open sourcemkd-cirt.mk
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourcecyberveille.ch
Open sourcegbhackers.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft said threat actor **Storm-1175** is running high-tempo intrusions that exploit newly disclosed and, in some cases, previously unknown vulnerabilities in internet-facing systems to steal data and deploy **Medusa ransomware** within days or even 24 hours. The financially motivated group has heavily impacted healthcare organizations and also targeted education, professional services, and finance in Australia, the United Kingdom, and the United States. Since 2023, the actor has exploited more than 16 flaws across products including **Microsoft Exchange**, **PaperCut**, **Ivanti**, **ConnectWise ScreenConnect**, **JetBrains TeamCity**, **SimpleHelp**, **CrushFTP**, **GoAnywhere MFT**, **SmarterMail**, **SAP NetWeaver**, and **BeyondTrust**, with Microsoft also observing zero-day use against SmarterMail and GoAnywhere before public disclosure. After gaining access, Storm-1175 establishes persistence with new administrator accounts, web shells, and remote management tools, then moves laterally using LOLBins, **Impacket**, **PDQ Deployer**, and Cloudflare tunnels while stealing credentials from **LSASS**, `NTDS.dit`, `SAM`, and backup systems. Microsoft said the actor tampers with Microsoft Defender settings to reduce detection, uses **Bandizip** and **Rclone** for collection and exfiltration, and deploys Medusa through PDQ Deployer or Group Policy; the group has also shown interest in Linux targets such as vulnerable **Oracle WebLogic** servers. Microsoft urged organizations to reduce exposure of web-facing assets, patch quickly, enforce MFA on approved RMM tools, restrict local administrator rights, and enable protections such as **Credential Guard**, tamper protection, and Defender XDR attack disruption features.
Jun 29, 2026
Storm-0249, an initial access broker previously known for selling access to compromised networks, has adopted advanced techniques to facilitate ransomware attacks. The group now leverages social engineering tactics such as ClickFix, which tricks users into executing malicious commands via the Windows Run dialog. These commands use legitimate utilities like `curl.exe` to download and execute fileless PowerShell scripts from spoofed Microsoft domains, ultimately deploying malicious MSI packages with SYSTEM privileges. The attack chain includes DLL sideloading, where a trojanized DLL is placed alongside legitimate EDR components (notably SentinelOne's `SentinelAgentWorker.exe`), allowing the attacker's code to run within trusted processes and evade detection. Once persistence is established, Storm-0249 abuses EDR tools to collect system information and maintain stealthy access, making detection and remediation challenging for defenders. This evolution in Storm-0249's tactics demonstrates a shift from mass phishing to highly targeted, stealthy operations that exploit trusted security software for malicious purposes. The abuse of EDR solutions not only enables the bypassing of traditional security controls but also provides a reliable foothold for ransomware deployment. Security researchers recommend implementing robust email filtering, monitoring for unusual use of legitimate utilities, and updating detection rules to identify these advanced techniques. Organizations are urged to review their EDR configurations and monitor for signs of DLL sideloading and unauthorized PowerShell activity to mitigate the risk posed by this threat actor.
Jun 29, 2026
**Ransomware activity is increasingly blending into normal IT operations** by combining exploitation of internet-facing software with the use of legitimate remote access and monitoring tools. Huntress reported multiple intrusions tied to the **Crazy** ransomware gang where attackers deployed *Net Monitor for Employees Professional* and the *SimpleHelp* remote support client to maintain persistence, evade detection, and stage for ransomware deployment. The actors installed the monitoring agent via `msiexec.exe` directly from the vendor site, then used it for interactive control (desktop viewing, file transfer, command execution); they also added redundant access by installing SimpleHelp via PowerShell and disguising binaries with benign-looking names (e.g., `vshost.exe`) and paths such as `C:\ProgramData\OneDriveSvc\OneDriveSvc.exe`. In parallel, ransomware groups have been observed **actively exploiting recently patched SmarterTools SmarterMail vulnerabilities** that enable unauthenticated compromise of mail servers. SC Media reported that CISA added **CVE-2026-24423** to the KEV catalog after it was linked to ransomware campaigns; the flaw enables unauthenticated RCE via SmarterMail’s `ConnectToHub` API by delivering a malicious OS command from a remote server. A second issue, **CVE-2026-23760**, allows authentication bypass through the password reset API (`force-reset-password`) by not validating the old password; ReliaQuest attributed active exploitation of this weakness to a China-based actor tracked as **Storm-2603**, which reportedly chained the bypass with SmarterMail’s *Volume Mount* feature to reach RCE, activity assessed as staging consistent with **Warlock** ransomware operations (even when ransomware was not yet deployed).
Jun 29, 2026