China-Linked Hackers Deploy New Storm Encryptor Ransomware, Likely via N-central Flaw
Summary: Microsoft reported that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented C++ ransomware strain called StormEncryptor, which appends the .encrypted extension to files and drops a ransom note named !!!README_FIRST!!!.txt in every scanned directory, a shift from the group's prior use of Medusa ransomware. Microsoft said the initial access likely involved exploitation of CVE-2026-18577, a newly disclosed flaw in N-able N-central assessed to be a patch bypass for CVE-2026-18556, both allowing authentication bypass and account takeover and both flagged by CISA as actively exploited.
Key Takeaway: Storm-1175 has been observed moving from initial access to data exfiltration and ransomware deployment mostly within a few days, exploiting the window between disclosure and patch adoption across a history that includes Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, FortiClient EMS, and Fortra GoAnywhere.