MalwareBleeping Computer
8.1 — CRITICAL
New StormEncryptor ransomware used by former Medusa affiliate
A financially motivated threat actor previously associated with the Medusa ransomware operation is now deploying a new ransomware strain called StormEncryptor. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A financially motivated threat actor, tracked as Storm-1175, has shifted away from Medusa ransomware and is now deploying the new StormEncryptor ransomware strain, exploiting CVE-2026-18577 vulnerability in N-central remote monitoring and management tool.
⚙️Technical Details
CVEs
CVE-2026-18577
Affected Systems
N-Able N-CentralGoAnywhere MFTSmarterTools SmarterMailMicrosoft ExchangeInvanti Connect SecureJetBrains TeamCity
Attack Vectors
NETWORK
💥Impact Assessment
Severity: critical
Who Is at Risk
System administrators managing self-hosted N-central servers and organizations with systems connected to the affected products
🛡️Recommended Actions
1Apply security patches for CVE-2026-18577 in N-central remote monitoring and management tool as soon as possible
2Monitor for Storm-1175 activity and apply additional security measures to prevent ransomware deployment
3Regularly check for signs of compromise, such as svchost.exe file in Documents folders or registered service named Cloudflared
📦Affected Products
N-Able N-CentralGoAnywhere MFTSmarterTools SmarterMailMicrosoft ExchangeInvanti Connect SecureJetBrains TeamCity
🔐NVD Verified DataVERIFIED
CVE-2026-18577 ↗CVSS 8.1 — HIGH
Attack Vector
NETWORK
Complexity
HIGH
Vector String
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-288
Affected Products (CPE)
N-Able N-Central
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.