A financially motivated threat actor previously tied to the Medusa ransomware operation has shifted to a new ransomware strain called StormEncryptor, according to Microsoft Threat Intelligence.

Microsoft tracks the group as Storm-1175 and assesses it is likely based in China. The actor has a history of exploiting zero-day and n-day vulnerabilities in enterprise software, including GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Ivanti Connect Secure, and JetBrains TeamCity, to gain initial access before deploying ransomware.

Likely Entry Point: N-central RMM Flaw

Microsoft says the recent StormEncryptor attacks were likely preceded by exploitation of an authentication-bypass vulnerability, tracked as CVE-2026-18577, in the N-central remote monitoring and management tool. N-able addressed the flaw with a hotfix (version 2026.3 HF1, build 2026.3.1.7) released on August 2, and is urging customers to patch immediately.

N-able has previously advised administrators to check for indicators of compromise, including an unexpected svchost.exe file located in users’ Documents folders, a registered service named Cloudflared, and inbound connections from IP addresses listed in its advisory.

Inside the StormEncryptor Attack Chain

StormEncryptor is written in C++ and appends encrypted files with the .encrypted extension. It drops a ransom note titled “!!!README_FIRST!!!.txt” into every scanned directory, giving victims three days to contact the attacker before stolen data is leaked publicly.

According to Microsoft, once Storm-1175 gains a foothold, it relies on legitimate remote access tools such as AnyDesk or SimpleHelp to maintain control of compromised systems, Advanced IP Scanner for network reconnaissance, and Mimikatz to harvest credentials from the LSASS process.

Microsoft notes this marks the group’s first observed activity since April 2026, describing the switch away from Medusa as a notable shift in tactics. The company warns that Storm-1175 moves unusually fast, often progressing from initial compromise to data exfiltration and ransomware deployment within just a few days.

Recommendations

  • Apply the N-central hotfix (2026.3 HF1/build 2026.3.1.7) immediately
  • Check self-hosted N-central servers for the documented indicators of compromise
  • Monitor for unauthorized use of AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz
  • Watch for rapid lateral movement and data exfiltration following any suspected initial access

Microsoft is urging organizations managing self-hosted N-central deployments to treat patching as an urgent priority given the speed at which Storm-1175 has historically operated.