China-Linked Storm-1175 Deploys StormEncryptor via N-central Flaw

Microsoft Threat Intelligence has revealed that Storm-1175, a China-based financially motivated threat actor, has deployed a previously undocumented ransomware strain called StormEncryptor in active attacks. The campaign represents a notable tactical shift for the group, which had previously relied on Medusa ransomware in its operations. StormEncryptor is written in C++ and appends the ".encrypted" extension to compromised files, while dropping a ransom note titled "!!!README_FIRST!!!.txt" in every scanned directory.

While Microsoft has not confirmed the exact exploit vector, investigators assess with high confidence that the threat actor weaponized CVE-2026-18577, a newly disclosed authentication bypass flaw in N-able N-central, to obtain initial access. The vulnerability is regarded as a patch bypass for the earlier CVE-2026-18556, with both enabling account takeover on unpatched deployments. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both flaws to its Known Exploited Vulnerabilities catalog, underscoring the urgency for administrators to patch immediately. Organizations running N-central should also verify their exposure by running a port scanner to confirm management interfaces are not publicly accessible, and audit any accounts for compromise using an email breach checker.

Storm-1175 has a well-documented history of chaining zero-day and N-day exploits against internet-facing enterprise tools, including Mirth Connect (CVE-2023-37679, CVE-2023-43208), ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708), JetBrains TeamCity (CVE-2024-27198, CVE-2024-27199), and Fortinet FortiClient EMS (CVE-2023-48788). In October 2025, Microsoft also attributed the actor to exploitation of Fortra GoAnywhere (CVE-2025-10035) for Medusa ransomware deployment. Post-compromise tradecraft in this latest wave includes abuse of remote monitoring and management tools AnyDesk and SimpleHelp, network reconnaissance via Advanced IP Scanner, and credential harvesting through LSASS dumps with Mimikatz. The group is known for compressing the entire attack chain from initial access to data exfiltration and encryption into a matter of days.

Defenders should prioritize patching CVE-2026-18577 across all N-central instances and review logs for indicators tied to Storm-1175. Given the actor's reliance on credential theft, security teams are advised to enforce phishing-resistant multi-factor authentication on RMM consoles and require complex, unique credentials that have not been exposed in prior incidents. IT administrators can validate the strength of administrative passwords with a password checker and rotate any that appear in known credential dumps. Rapid patch adoption, account hardening, and continuous monitoring of internet-facing management infrastructure remain the most effective defenses against this high-velocity adversary.