Breaking: Storm-1175 Deploys New Ransomware via N-able N-central God Mode Flaw — 11 August 2026

Storm-1175 Deploys New StormEncryptor Ransomware via N-able N-central "God Mode" Flaw

China-linked threat actor Storm-1175 has deployed a previously undocumented ransomware strain called StormEncryptor, likely using the actively exploited N-able N-central authentication bypass (CVE-2026-18577) as the initial access vector. Microsoft Threat Intelligence disclosed the new ransomware on August 10, marking a significant escalation: the group previously deployed Medusa ransomware and has now built its own custom C++ encryptor. N-able has shipped a second emergency hotfix because the first patch was bypassed, and has confirmed that attackers reached customer networks through compromised N-central servers.

What Happened

On July 31, N-able's Adlumin MDR detected unusual activity on a customer's N-central server. Investigation revealed a threat actor exploiting CVE-2026-18577, an authentication bypass that is itself a bypass of an earlier patch (CVE-2026-18556). The attacker found a variation that circumvented the first hotfix's specific checks. CVE-2026-18577 grants unauthenticated administrative access to N-central, the RMM platform used by thousands of MSPs to manage customer endpoints.

N-able confirmed that attackers leveraged the platform's built-in Take Control feature to connect to managed endpoints, then deployed Cloudflare Tunnel (cloudflared) for persistent access. Post-exploitation activity includes creating a domain account named "veeam," resetting existing domain administrator passwords, installing additional remote access tools (AnyDesk, SimpleHelp), running Advanced IP Scanner for discovery, dumping LSASS with Mimikatz, and disabling Microsoft and Sophos security software using an EDR-evasion tool.

Microsoft attributed the campaign to Storm-1175, a China-based financially motivated group with a track record of exploiting freshly disclosed vulnerabilities in internet-facing systems. The group's previous targets include Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, Fortinet FortiClient EMS, and Fortra GoAnywhere. StormEncryptor is written in C++, appends the .encrypted extension to files, and drops a ransom note named "!!!README_FIRST!!!.txt."

N-able released Hotfix 2 (version 2026.3.1.10) on August 6, stating it is required even if Hotfix 1 was already applied. The company shared six IP addresses associated with the attacks. Sophos and Huntress have published additional indicators of compromise.

Why This Matters

This is an RMM supply chain compromise. A single authentication bypass in N-central gives the attacker administrative control of every managed endpoint across every customer of every affected MSP. The attack path goes: exploit N-central → Take Control feature → managed endpoint → domain admin → ransomware deployment. And it happens fast. Microsoft notes that Storm-1175 typically moves from initial access to data exfiltration and ransomware deployment within a few days.

The fact that the first patch was bypassed adds another dimension. Organizations that applied Hotfix 1 and thought they were protected are not. Hotfix 2 is mandatory, and even N-able acknowledges that patching the server alone may not be sufficient without also upgrading agents on managed devices.

The shift from Medusa (a ransomware-as-a-service tool) to StormEncryptor (custom-built) signals that Storm-1175 is investing in its own tooling. Custom ransomware means the group controls its own encryption, its own negotiation infrastructure, and its own operational tempo. It also means traditional Medusa indicators no longer apply for detection.

Who Is Affected

Any organisation running N-able N-central on-premises (versions prior to 2026.3.1.10). Hosted N-central environments have been patched automatically. All MSPs and their customers whose endpoints were managed by unpatched N-central servers are potentially compromised.

Organisations in any sector using N-central for remote monitoring and management. Storm-1175 does not appear to be targeting specific verticals. The initial access is opportunistic: exploit the RMM, then pivot.

So What / Action

Apply N-central Hotfix 2 (version 2026.3.1.10) immediately. Hotfix 1 is not sufficient. If you applied only Hotfix 1, treat your environment as potentially compromised.

Upgrade N-central agents on managed devices. N-able says this is recommended but not required for server-side protection. Given the post-exploitation behavior observed (Take Control pivoting, Cloudflare Tunnel persistence), agent upgrades close additional attack surface.

Assume breach for any N-central instance that was unpatched between August 1 and now. Hunt for the specific indicators: Cloudflared service installations, accounts named "veeam," modified domain administrator passwords, Take Control session logs to unexpected endpoints, AnyDesk or SimpleHelp installations on managed devices, and LSASS dump activity. The six known attacker IPs and Sophos/Huntress IOCs should be blocklisted and searched in historical logs.

Check for StormEncryptor artifacts: files with .encrypted extension and ransom notes named "!!!README_FIRST!!!.txt." If found, the timeline from initial access to ransomware deployment is likely measured in days, not weeks.

Sources: Microsoft Threat Intelligence, N-able Security Advisory, CISA KEV Catalog, Sophos, Huntress, Rapid7, Help Net Security, The Hacker News