A Chinese Ransomware Crew Swaps Tools, Not Tactics: Storm-1175's Pivot to StormEncryptor Exposes the Fragility of the MSP Layer- 338
August 16, 2026
For a financially motivated hacking crew that had gone quiet since April, the reappearance of Storm-1175 in early August carried a message beyond the ransom notes it left behind: state-adjacent criminal groups no longer need new tradecraft to stay dangerous, only a fresh exploit and a new piece of malware to wrap around old habits.
On August 2, the China-based actor began deploying a previously undocumented ransomware strain, StormEncryptor, retiring the Medusa payload it had used in prior campaigns. The shift in tooling masked a continuity in method — rapid exploitation of a freshly disclosed vulnerability, abuse of the very software meant to secure client networks, and a compression of the intrusion timeline that leaves defenders almost no margin to respond.
Storm-1175 is not a new name to Microsoft Threat Intelligence, which has tracked the group's exploitation of more than sixteen vulnerabilities since 2023 across products including Microsoft Exchange, Ivanti Connect Secure, JetBrains TeamCity, GoAnywhere MFT and SmarterTools SmarterMail, chaining flaws where necessary to escalate from initial foothold to remote code execution on both Windows and Linux systems, and on occasion weaponizing zero-days before public disclosure. Its earlier campaigns, built around Medusa, targeted finance, healthcare, education and professional-services organizations across the United States, the United Kingdom and Australia, favoring speed over stealth: initial access to full encryption in under twenty-four hours.
The current campaign's entry point is CVE-2026-18577, an authentication-bypass vulnerability in N-able's N-central remote monitoring and management platform, the console many managed service providers use to patch and oversee client endpoints and servers. Microsoft has not formally confirmed the access vector, but the timing is difficult to read otherwise: StormEncryptor deployments began the same day the flaw was disclosed. N-able says it first identified active exploitation on July 31; its initial advisory understated the scope of the problem, and a first patch proved ineffective against attacks already under way, prompting two further emergency fixes before a hotfix (version 2026.3 HF1, build 2026.3.1.7) shipped on August 2. The vulnerability itself, carrying a CVSS score of 8.2, followed an earlier and similarly unsuccessful attempt to close a separate N-central authentication-bypass flaw, CVE-2026-18556, and was added to CISA's Known Exploited Vulnerabilities catalog on August 3. Huntress, which has tracked the exploitation independently, describes the bug as granting unauthenticated attackers "god-mode" access — full administrative control of the N-central server itself, with no credentials required.
That distinction matters because of what an N-central server represents structurally: a single point of command over every endpoint it manages on behalf of downstream clients. Compromise the server and an attacker inherits, at a stroke, remote access to an entire portfolio of otherwise unrelated organizations — the same supply-chain arithmetic that turned the 2021 Kaseya breach into a campaign against roughly sixty direct customers and some 1,500 downstream victims via REvil, and that made ConnectWise's ScreenConnect a magnet for multiple ransomware crews, Storm-1175 among them, following its own 2024 compromise. N-able has said it has contacted a limited number of affected customers; Huntress has confirmed some of its own clients were hit and has published a lateral-movement timeline for two cases, but neither company has verified the full extent of downstream compromise — a gap that is itself characteristic of RMM-borne supply-chain incidents, where the blast radius is rarely visible until well after the fact.
Once inside, Storm-1175's tradecraft blends legitimate administrative tooling with familiar credential-theft techniques. The group is reported to abuse N-central's Take Control Manager function to deploy Cloudflare-based tunnels for covert command-and-control, alongside AnyDesk and SimpleHelp for remote access, Advanced IP Scanner for network discovery, and Mimikatz to harvest credentials from the LSASS process. From there it escalates via Remote Desktop Protocol to domain controllers, installing PsExec and using Windows Management Instrumentation, PDQ Deployer and Impacket to move laterally, create new administrative accounts, and ultimately extract Active Directory data, including password hashes, across the compromised environment. StormEncryptor itself, written in C++, appends the extension ".encrypted" to locked files and drops a ransom note — "!!!README_FIRST!!!.txt" — in every scanned directory, giving victims three days to negotiate before stolen data is published. Victims already named on the group's leak site span e-commerce, fintech, healthcare and home-security firms, a sectoral spread consistent with the crew's earlier, broader targeting.
Microsoft's own framing of the group's cadence — from initial access to data theft and ransomware deployment within a few days, sometimes within twenty-four hours — is the throughline connecting the Medusa era to the StormEncryptor one. What has changed is the encryptor; what has not is Storm-1175's core competency, exploiting a narrow window between a vulnerability's disclosure and an organization's ability to patch it, and doing so specifically against the infrastructure — RMM platforms — built to give defenders visibility and control. That a financially motivated, China-based actor keeps finding its fastest path to mass compromise through the tools administrators trust most is less a story about one vulnerable product than about a structural weak point in how managed services are secured across the industry.
