China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

1. Executive summary

Microsoft has disclosed that the financially motivated actor Storm-1175 — assessed as China-linked but with no MITRE ATT&CK profile, meaning attribution is unconfirmed — has deployed a new C++ ransomware strain dubbed StormEncryptor, marking a shift from the group's prior use of Medusa. Initial access is likely achieved by exploiting CVE-2026-18577, a newly disclosed authentication-bypass flaw in N-able N-central that functions as a patch bypass for CVE-2026-18556; both CVEs are flagged by CISA as actively exploited in the wild. The actor moves rapidly from initial access to data exfiltration and encryption, typically within days, and abuses legitimate RMM tooling post-compromise. EMEA financial services running N-central as a managed-service platform face elevated risk of account takeover, lateral movement, and ransomware impact on internet-facing infrastructure.

2. Regulatory framing

3. Technical analysis & attack chain

Attribution caveat: Storm-1175 is described by Microsoft as a China-based, financially motivated threat actor. The VERIFIED REFERENCE DATA contains no MITRE ATT&CK profile for this actor; attribution is therefore unconfirmed beyond Microsoft's own reporting. This advisory relies on a single primary source (The Hacker News, citing Microsoft Threat Intelligence Bluesky posts) for the StormEncryptor details; the CVE and CISA-KEV claims are corroborated by the source's reference to CISA flagging.

Attack chain (confirmed steps from source)

1. Initial access (likely): Exploitation of CVE-2026-18577 in N-able N-central to achieve authentication bypass and account takeover. CVE-2026-18577 is a patch bypass for CVE-2026-18556, which permits the same authentication-bypass/account-takeover class. The exact exploitation mechanism is not specified in the source; Microsoft characterises it as "likely" rather than confirmed. Both CVEs are flagged by CISA as actively exploited in the wild. No CVSS scores, CISA-KEV remediation deadlines, or specific N-central versions are provided in the source material.
2. Post-compromise tooling: Storm-1175 abuses remote monitoring and management (RMM) tools — specifically AnyDesk or SimpleHelp — for remote access. Advanced IP Scanner is used for network discovery. Mimikatz is used for LSASS memory dumping, indicating credential theft for lateral movement or privilege escalation.
3. Data exfiltration: The actor performs data exfiltration prior to ransomware deployment. The source does not specify exfiltration tools, protocols, or C2 infrastructure.
4. Ransomware deployment: StormEncryptor is deployed. Technical specifics from source: - Written in C++. - Appends the file extension .encrypted to encrypted files. - Drops a ransom note named !!!README_FIRST!!!.txt to every scanned directory. - No encryption algorithm, C2 callback, persistence mechanism, or specific file-targeting behaviour is described in the source.
5. Timeline: Microsoft reports that the actor moves from initial access to exfiltration and ransomware deployment "mostly within a few days," indicating a high-velocity attack profile.

Historical context (corroborated): Storm-1175 has a documented track record of exploiting internet-facing vulnerabilities to deploy Medusa ransomware, including:

• Mirth Connect (CVE-2023-37679, CVE-2023-43208)
• ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708)
• JetBrains TeamCity (CVE-2024-27198, CVE-2024-27199)
• Fortinet FortiClient EMS (CVE-2023-48788)
• Fortra GoAnywhere (CVE-2025-10035) — attributed by Microsoft in October 2025 analysis.

The group weaponises a combination of zero-days and N-days, exploiting the window between disclosure and patch adoption.

4. Mitigation & containment

P1 — within 24 hours

• Patch N-central: Apply vendor patches for both CVE-2026-18577 and CVE-2026-18556 immediately. CVE-2026-18577 is a patch bypass for CVE-2026-18556 — patching only the earlier CVE is insufficient. Verify with N-able that the installed version addresses both flaws. The source does not specify fixed versions; check the vendor advisory directly.
• Isolate internet-facing N-central instances: If patching cannot be completed immediately, restrict N-central management interfaces to VPN or allowlisted IP ranges. Remove direct internet exposure.
• Hunt for AnyDesk / SimpleHelp abuse: Review all systems managed via N-central for unauthorised AnyDesk or SimpleHelp installations and active sessions. Block these RMM tools at the network egress if they are not part of the standard toolset.
• Check for Mimikatz / LSASS access: Deploy EDR rules alerting on LSASS process memory access (typical Mimikatz behaviour). On Windows endpoints, enable LSASS protection (RunAsPPL) where feasible.

P2 — within 72 hours

• Audit N-central account integrity: Review all administrative and service accounts in N-central for unauthorised creation, privilege changes, or anomalous logins. Reset credentials for all N-central accounts.
• Network discovery tool detection: Block or alert on Advanced IP Scanner execution across the estate. If it is a sanctioned tool, restrict to specific admin workstations and alert on usage from any other host.
• Ransomware indicator sweep: Search file systems and backup repositories for files with the .encrypted extension and for files named !!!README_FIRST!!!.txt. If found, isolate affected systems immediately and initiate incident response.
• Review external-facing services: Given Storm-1175's history of exploiting internet-facing vulnerabilities (Mirth Connect, ScreenConnect, TeamCity, FortiClient EMS, GoAnywhere), verify that all previously patched products remain current and that no exposed instances are running vulnerable versions.

P3 — within 7 days

• RMM tool governance: Establish or update allowlist policies for RMM software (AnyDesk, SimpleHelp, and similar). Monitor for shadow IT RMM deployments via EDR software-inventory feeds.
• Credential hygiene: Force rotation of all credentials that may have been exposed via LSASS dumping, including service-account credentials cached on endpoints managed by N-central.
• Backup verification: Confirm offline/immutable backups are current and test restoration procedures. StormEncryptor's rapid deployment timeline leaves minimal reaction window once encryption begins.

5. Indicators of compromise

No atomic network indicators (IPs, domains, URLs, hashes) are present in the source material. The following file-system artefacts and tool names are described:

file_extension  .encrypted
ransom_note  !!!README_FIRST!!!.txt
tool  AnyDesk
tool  SimpleHelp
tool  Advanced IP Scanner
tool  Mimikatz

Behavioural indicators

6. Detection

rule StormEncryptor_Ransomware {
  meta:
    author = "Adverse Trace"
    date = "2026-08-10"
    reference = "https://thehackernews.com/2026/08/china-linked-hackers-deploy-new.html"
    description = "Detects StormEncryptor ransomware based on ransom note filename and file extension artefacts"
    tlp = "AMBER"

  strings:
    $ransom_note = "!!!README_FIRST!!!.txt" ascii wide nocase
    $ext_encrypted = ".encrypted" ascii wide nocase

  condition:
    2 of them
}

title: Storm-1175 Post-Compromise Tooling — RMM Abuse and LSASS Dumping
id: 7a3c1f2e-4b5d-4a9c-8e1f-6d2b3c4d5e6f
status: experimental
description: >
  Detects Storm-1175 post-compromise behaviours: AnyDesk or SimpleHelp RMM
  execution, Advanced IP Scanner discovery activity, and Mimikatz LSASS
  memory access. Correlate with N-central authentication events for high
  confidence.
author: Adverse Trace
date: 2026/08/10
references:

  - https://thehackernews.com/2026/08/china-linked-hackers-deploy-new.html
tags:

  - attack.execution
  - attack.credential_access
  - attack.discovery
  - attack.t1003.001
  - attack.t1219

logsource:
  product: windows
  category: process_creation

detection:
  selection_rmm:
    Image|endswith:

      - '\AnyDesk.exe'
      - '\SimpleHelp.exe'
  selection_scanner:
    Image|endswith:

      - '\advanced_ip_scanner.exe'
      - '\ipscan.exe'
  selection_mimikatz:
    Image|endswith:

      - '\mimikatz.exe'
    CommandLine|contains:

      - 'sekurlsa::lsass'
      - 'lsadump::lsass'
  selection_lsass_access:
    TargetFilename|contains:

      - 'lsass'
    CommandLine|contains:

      - 'procdump'
      - 'lsass'
      - 'sekurlsa'
  condition: selection_rmm or selection_scanner or selection_mimikatz
falsepositives:

  - Legitimate administrative use of AnyDesk, SimpleHelp, or Advanced IP Scanner
  - Authorised Mimikatz use in security testing
level: high

7. Sources

• The Hacker News, "China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw," https://thehackernews.com/2026/08/china-linked-hackers-deploy-new.html, 2026-08-10

8. Adverse Trace position

This is a high-severity active threat. CISA has confirmed in-the-wild exploitation of both CVE-2026-18577 and CVE-2026-18556 in N-able N-central, and the actor demonstrates a rapid operational tempo from initial access to ransomware deployment. The shift to a new ransomware payload (StormEncryptor) indicates the group is iterating tooling, which complicates signature-based detection. Attribution to Storm-1175 is unconfirmed beyond Microsoft's reporting (no MITRE ATT&CK profile exists for this actor); the advisory is single-sourced via The Hacker News citing Microsoft Bluesky posts — clients should verify against Microsoft's original threat intelligence publications before enforcement actions. EMEA financial services using N-central as an RMM/MSP platform should treat patching of both CVEs as an immediate operational priority and should hunt for the described post-compromise tooling (AnyDesk, SimpleHelp, Advanced IP Scanner, Mimikatz) across managed endpoints. Adverse Trace will monitor for Microsoft's full technical write-up, additional IOCs, and any CISA KEV remediation deadlines, and will issue an update if the source material expands.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.