A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor, according to BleepingComputer, citing Microsoft Threat Intelligence. Microsoft tracks the actor as Storm-1175 and says recent attacks were likely preceded by exploitation of CVE-2026-18577, an authentication-bypass vulnerability in N-able’s N-central remote monitoring and management tool. The report frames StormEncryptor as a notable change in tooling for Storm-1175. BleepingComputer says Microsoft described the activity as the first it had observed from the actor since April 2026 and as a shift away from Medusa, which the actor had previously been known to use. Storm-1175 is believed to be China-based, according to the same report. Microsoft researchers found that StormEncryptor is written in C++, BleepingComputer reports. The malware appends encrypted files with the “.encrypted” filename extension and drops a ransom note called “!!!README_FIRST!!!.txt” into every scanned directory. The ransom note gives victims three days to contact the attacker and negotiate payment; otherwise, it threatens that stolen data will be leaked online. The reported intrusion path follows a familiar ransomware sequence: initial access, remote management, discovery, credential theft, data theft and encryption. After gaining access, the attacker used AnyDesk or SimpleHelp for remote management, Advanced IP Scanner for network discovery and Mimikatz to dump credentials from the Local Security Authority Subsystem Service process, according to BleepingComputer’s summary of Microsoft’s findings. Microsoft said Storm-1175 moves quickly from initial compromise to data exfiltration and ransomware deployment, often within a few days, BleepingComputer reports. That compressed timeline is the operational detail that matters for defenders: once the actor is inside, the window for containment may be short. N-able addressed CVE-2026-18577 with a hotfix, 2026.3 HF1/build 2026.3.1.7, released on August 2, according to the report. The company urged customers to install the patch immediately. BleepingComputer also reports that N-able previously advised administrators to check for signs of compromise, including an svchost.exe file in users’ Documents folders, a registered service named Cloudflared and inbound connections from IP addresses listed in the advisory. For security teams, the immediate scope is specific: self-hosted N-central servers. The available reporting does not establish how many organizations were affected, how many attacks have used StormEncryptor or whether the campaigns are continuing at scale. But the combination of remote monitoring and management exposure, credential dumping and ransomware deployment is enough to make patching and compromise checks time-sensitive for affected environments. Who benefits: Organizations running self-hosted N-central benefit most from immediate patching and compromise review. Defenders also gain concrete detection leads from the reported tools, filenames and service names. Who's exposed: Administrators of unpatched self-hosted N-central servers are the clearest exposed group in the provided reporting. Victims may also face data-leak pressure because the ransom note reportedly threatens publication of stolen data after three days.