Reported by 2 outlets

Timeline

1. original reporting

   Storm-1175 Deploys StormEncryptor Ransomware as Third Strain — China-Based Former Medusa Affiliate

   bleepingcomputer.com · 64d ago · August 11th, 2026

   Microsoft Threat Intelligence attributes the new StormEncryptor ransomware family to Storm-1175, a financially motivated actor believed to be China-based whose recent attacks were likely preceded by exploitation of CVE-2026-18577, the N-able N-central authentication bypass added to CISA's KEV catalog this month. The deployment marks the actor's third ransomware strain in recent months, following Medusa and prior tooling, with a history of exploiting zero-days and n-days in GoAnywhere MFT, SmarterTools SmarterMail, Microsoft Exchange, Ivanti Connect Secure, and JetBrains TeamCity. Organizations running N-central should treat the appliance as compromised if unpatched and hunt for StormEncryptor artifacts.

2. update from gbhackers.com

   Storm-1175 Debuts StormEncryptor Ransomware, Tied to Weaponized N-able Flaw

   gbhackers.com · 67d ago · August 8th, 2026

   Microsoft Threat Intelligence attributes the previously undocumented StormEncryptor ransomware family to financially motivated actor Storm-1175, whose first campaign since April swapped Medusa for a custom C++ encryptor starting August 2. The push may be tied to the rapid weaponization of CVE-2026-18577, the N-able N-central authentication bypass CISA added to its KEV catalog this week. Patch N-central instances immediately and hunt for StormEncryptor encryption artifacts.

3. update from bleepingcomputer.com

   StormEncryptor ransomware used by former Medusa affiliate

   bleepingcomputer.com · 64d ago · August 10th, 2026

   It was previously linked to Medusa ransomware, targeting systems via zero-day and n-day flaws in various products, including GoAnywhere MFT , SmarterTools SmarterMail, Microsoft Exchange, Invanti Connect Secure, and JetBrains TeamCity. “Storm-1175’s deployment of StormEncryptor marks the threat actor’s first activity observed by Microsoft Threat Intelligence since April 2026, and a shift away from Medusa ransomware, which the threat actor had previously been known to use,” Microsoft states. The researchers found that StormEncryptor is a C++ malware that appends encrypted files with the “.encrypted” filename extension and drops a ransom note named ‘!!!README_FIRST!!!.txt’ into every scanned directory. The ransom note gives victims three days to reach out to the attacker and negotiate a ransom payment. Alternatively, the stolen data would be leaked online. StormEncryptor ransom note Source: Microsoft After gaining access to the target network, the attacker used AnyDesk or SimpleHelp for remote management, Advanced IP