Microsoft has documented StormEncryptor, a previously unseen ransomware family written in C++, deployed by Storm-1175 — a China-linked, financially motivated group.

The malware itself is unremarkable. It appends .encrypted to files and drops a ransom note named !!!README_FIRST!!!.txt. What is worth reading is how the group got in, and what the switch away from Medusa signals.

The initial access

Storm-1175 likely exploited CVE-2026-18577 in N-able N-central — a remote monitoring and management platform used by MSPs.

That CVE is assessed as a patch bypass for CVE-2026-18556. Both enable authentication bypass and account takeover. CISA has flagged both as actively exploited in the wild.

We wrote about the incomplete patch when the bypass was disclosed. This is the part of that story where it shows up in an intrusion.

The pattern is worth stating cleanly, because it recurs:

  1. A vulnerability is disclosed and patched.
  2. The patch addresses the specific input, not the underlying flaw.
  3. A bypass is found.
  4. Organisations that applied patch one believe they are done.

Step four is what makes patch bypasses disproportionately valuable to an attacker. The target population is not "everyone unpatched" — it is "everyone who patched and stopped looking."

Why an RMM platform

N-central is what a managed service provider uses to administer its clients' machines. Compromising it is not compromising one network. It is compromising the tool that has agent-level access to all of them.

That is the whole reason RMM platforms sit near the top of every ransomware crew's target list, and why an authentication bypass in one is not comparable to an authentication bypass in an ordinary web application.

Post-compromise

  • AnyDesk or SimpleHelp for remote access
  • Advanced IP Scanner for reconnaissance
  • Mimikatz for credential dumping
  • Rapid movement from initial access to exfiltration to ransomware — typically within days

Every one of those is a legitimate tool. AnyDesk and SimpleHelp are remote support software; an MSP environment is full of both, which makes them nearly invisible in that context. Advanced IP Scanner is a free network tool. Mimikatz is the only item on the list that has no innocent explanation.

The "within days" cadence matches what we have seen across this year's ransomware operations — the dwell times that used to be measured in weeks are now measured in the length of a long weekend.

The Medusa-to-StormEncryptor shift

Storm-1175's history is a list of edge-device and platform exploitation:

  • Mirth Connect
  • ConnectWise ScreenConnect
  • JetBrains TeamCity
  • Fortinet FortiClient EMS
  • Fortra GoAnywhere

All previously used to deploy Medusa.

Moving to a custom C++ locker changes the group's economics. Medusa is a RaaS — a share of every payment goes to the operator, and the tooling is shared with other affiliates, which means shared detections. A private locker means no cut, no shared signatures, and no dependency on someone else's infrastructure staying up.

For defenders it means one specific thing: detections tuned to Medusa will not fire. The behavioural chain is identical; the payload is not.

What to do

  • Confirm you are on the N-central release that fixes CVE-2026-18577, not merely the one that fixed CVE-2026-18556. This is the single highest-value item here.
  • If you are an MSP, treat your RMM as tier-zero infrastructure. Same controls as a domain controller: MFA, restricted network exposure, dedicated admin accounts, alerting on authentication anomalies.
  • Alert on AnyDesk and SimpleHelp installs that your own process did not initiate. In an MSP environment this needs an allowlist of known-good deployments to be useful.
  • Hunt for .encrypted extensions and !!!README_FIRST!!!.txt as a late-stage indicator — useful for scoping, not for prevention.
  • Do not assume Medusa detections cover this. Rebuild detection around behaviour: Advanced IP Scanner plus Mimikatz plus a new remote-access tool, in that sequence, inside a few days.

The through-line: the intrusion did not require anything new. It required a patch that was applied once and a bypass that nobody re-checked for.