Storm-1175 deploys StormEncryptor ransomware

Storm-1175 deploys StormEncryptor ransomware

Microsoft disclosed that Storm-1175, a threat actor linked to China, has been using a previously unseen ransomware strain named StormEncryptor in active attacks against enterprise environments. The malware is written in C++ and encrypts victim files, appending the .encrypted extension. It also drops a ransom note called !!!README_FIRST!!!.txt in directories it scans on compromised systems.

Microsoft assessed that the group likely gained initial access through CVE-2026-18577, a newly disclosed authentication bypass flaw in N-able’s N-central remote monitoring and management platform. The flaw was described as a patch bypass for CVE-2026-18556, meaning systems that had applied the earlier fix could still be exposed through a second route to the same outcome. Both vulnerabilities allow authentication bypass and full account takeover, and CISA has identified them as actively exploited.

Key Events

  • Microsoft identified Storm-1175 as a financially motivated threat actor linked to China.
  • The group was observed deploying a previously undocumented ransomware strain called StormEncryptor.
  • StormEncryptor is written in C++ and encrypts files before appending the .encrypted extension.
  • The malware places a ransom note named !!!README_FIRST!!!.txt in scanned directories.
  • Microsoft assessed CVE-2026-18577 in N-able N-central as the likely initial access vector.
  • CVE-2026-18577 was described as a patch bypass for CVE-2026-18556 and enabled authentication bypass and account takeover.
  • CISA flagged both vulnerabilities as actively exploited in the wild.