Microsoft has come up with a disclosure that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor in active campaigns targeting enterprise environments. The shift marks a departure from the group’s previous reliance on Medusa ransomware and signals that Storm-1175 is now building custom malware tools rather than renting existing ones.
In the first quarter of 2024, established ransomware families like Akira, Lockbit, Play, and Phobos were still the most predominantly used in attacks observed by Microsoft. Microsoft now tracks 75 active ransomware families.
— Microsoft Threat Intelligence (@MsftSecIntel) April 19, 2024
StormEncryptor: The Ransomware
StormEncryptor is written in C++ and appends a “.encrypted” extension to every file it encrypts on a victim’s system, then drops a ransom note titled “!!!README_FIRST!!!.txt” into every scanned directory on the compromised machine. Microsoft’s Threat Intelligence Team published the technical details through a series of posts on Bluesky, providing the first public documentation of the new strain alongside indicators of compromise.
The initial access vector likely involves CVE-2026-18577, a newly disclosed authentication bypass vulnerability in N-able’s N-central remote monitoring and management platform. Microsoft assesses this flaw as a patch bypass for the earlier CVE-2026-18556, meaning organizations that applied the first fix remained vulnerable to a second exploitation path that achieved the same outcome. Both vulnerabilities enable authentication bypass and complete account takeover on affected N-central servers, and CISA has flagged both as actively exploited in the wild.
Behind the Wheels
Storm-1175 has built its operational history around weaponizing the gap between vulnerability disclosure and patch adoption with devastating efficiency. The group’s target list reads like a catalog of enterprise software chokepoints: Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, Fortinet FortiClient EMS, and Fortra GoAnywhere have all served as initial access vectors in previous campaigns. Microsoft attributed a GoAnywhere exploitation campaign deploying Medusa ransomware to the group as recently as October 2025, establishing a pattern of systematically targeting managed service provider infrastructure.
The post-compromise behavior follows a rapid, well-rehearsed playbook that compresses the attack timeline from initial access to data exfiltration and ransomware deployment into just a few days. Once inside a network, Storm-1175 deploys either AnyDesk or SimpleHelp as remote monitoring tools to maintain persistent access. The group uses Advanced IP Scanner for network discovery to map the victim’s internal environment, then dumps credentials from LSASS using Mimikatz to escalate privileges and move laterally across the compromised network.
The speed matters because it eliminates the detection window that security teams typically rely on to identify and contain intrusions before they reach the encryption stage. Most enterprise security operations assume days to weeks between initial compromise and ransomware deployment, giving detection tools and human analysts time to intervene. Storm-1175 collapses that timeline into a period so short that many organizations discover the breach only after their files are already encrypted and the ransom note is sitting in every directory.
Microsoft urged customers to apply N-central patches immediately, noting that the threat actor’s velocity from exploitation to encryption makes delayed patching functionally equivalent to leaving systems entirely unpatched.
