Storm-1175 Launches StormEncryptor Ransomware Attacks Using N

Gbhackers •Eswar • August 8, 2026

Microsoft Threat Intelligence has identified a new ransomware campaign attributed to the financially motivated threat actor Storm-1175 that began deploying a previously undocumented ransomware strain, StormEncryptor, on August 2, 2026. The activity represents Storm-1175’s first observed operation since April 2026 and signals a notable shift in its ransomware tooling. The group was previously associated with […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Storm-1175 Deploys New StormEncryptor Ransomware Targeting N-central Systems A financially motivated threat actor, Storm-1175, previously linked to Medusa ransomware, has begun deploying a new ransomware strain named StormEncryptor. This campaign was initiated after exploiting an authentication-bypass vulnerability (CVE-2026-18577) in the N-central remote monitoring tool. The ransomware, written in C++, encrypts files and appends the '.encrypted' extension, dropping a ransom note demanding payment within three days. Storm-1175 is believed to be based in China and has rapidly transitioned from initial access to data exfiltration and ransomware deployment. Microsoft Threat Intelligence has confirmed that this is the first activity observed from Storm-1175 since April 2026. N-able, the vendor of N-central, released a hotfix for the CVE on August 2, 2026, urging immediate installation. Organizations are advised to monitor for signs of Storm-1175 activity and apply security patches promptly. 11 sources 79

Storm-1175 Launches StormEncryptor Ransomware Attacks Using N

The full story

Extracted Entities

Attack Types (1)

Ransomware Groups (1)