New StormEncryptor ransomware used by former Medusa affiliate

Microsoft Threat Intelligence identifies the financially motivated group Storm-1175 as deploying a new C++ ransomware variant named StormEncryptor, marking its first activity since April 2026 and a departure from the Medusa operation. The intrusion vectors reportedly involve the exploitation of authentication-bypass vulnerability CVE-2026-18577 in N-able's N-central remote monitoring and management software. Once inside the network, the threat actor utilizes tools like Mimikatz for credential theft before encrypting files with a .encrypted extension and demanding payment within three days.

N-able released a mitigation for this critical flaw in August 2026, specifically hotfix build 2026.3.1.7, urging administrators to verify systems for signs of compromise such as unauthorized svchost.exe processes or registered Cloudflared services.