Microsoft Identifies Rapid Tactics Change by Storm-1175 with New Ransomware Deployment
In a recent update, Microsoft Threat Intelligence has uncovered a concerning evolution in the tactics employed by Storm-1175, a financially motivated threat actor based in China. This group, previously recognized for utilizing Medusa ransomware, has transitioned to a new variant called StormEncryptor. The shift in methodology began on August 2, 2026, when Storm-1175 initiated the deployment of this new ransomware strain. The malware itself, developed in C++, encrypts files and appends an .encrypted extension, while also leaving behind a ransom note titled !!!README_FIRST!!!.txt in every affected directory.
Experts at Microsoft suspect that the current ransomware campaign leverages CVE-2026-18577, a recently disclosed authentication bypass vulnerability in N-able. This vulnerability was publicly disclosed on the same day that StormEncryptor began its deployment and was quickly added to the Cybersecurity and Infrastructure Security Agency’s (CISA) catalog of Known Exploited Vulnerabilities the following day. This rapid adoption highlights the threat actor’s adeptness at exploiting vulnerabilities before organizations have an opportunity to apply necessary patches.
Storm-1175 has built a reputation for quickly weaponizing new vulnerabilities, having exploited over 16 different vulnerabilities across various platforms since the beginning of 2023. These platforms include widely-used systems such as Microsoft Exchange, Ivanti Connect Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, GoAnywhere MFT, and SmarterMail. Evidence suggests that in certain instances, the group has utilized vulnerabilities within just a day of their public disclosure, and even demonstrated the capability to exploit zero-day flaws prior to them being made publicly aware.
The technical sophistication of Storm-1175 is evident in their approach to attacks. The group typically chains together multiple exploits to secure deeper system access, targeting both Windows and Linux environments. Upon gaining initial access, Storm-1175 installs web shells or remote access tools such as AnyDesk and SimpleHelp, creating administrative accounts to ensure persistence. Their methods extend to using Advanced IP Scanner to map network infrastructure comprehensively. Moreover, the threat actors employ credential theft tools, notably Mimikatz, to extract credentials from the Local Security Authority Subsystem Service (LSASS) and further infiltrate networks with techniques using PowerShell, PsExec, Remote Desktop Protocol (RDP), and Cloudflare tunnels.
The primary focus of Storm-1175 includes organizations within critical sectors such as healthcare, education, finance, and various service industries across the United States, United Kingdom, and Australia. What is particularly alarming about this threat is the speed at which it operates; Microsoft has reported instances in which attackers progressed from gaining initial access to executing data theft and deploying ransomware—all within a mere 24 hours. This accelerated attack timeline presents a formidable challenge for security defenders, significantly reducing their window for detection and mitigation before catastrophic damage ensues.
In light of the swift and aggressive tactics used by Storm-1175, Microsoft urges organizations to prioritize immediate patching of all known vulnerabilities, especially CVE-2026-18577 and other flaws cataloged by CISA. Security teams are encouraged to vigilantly monitor for suspicious installations of remote access tools, unauthorized creation of administrative accounts, and any unusual lateral movement activities within their network.
To bolster defenses against the fast-moving assaults characteristic of Storm-1175, organizations should implement several strategic measures. This includes the segmentation of networks, the maintenance of offline backups, and the establishment of rapid incident response protocols. Given the group’s pronounced ability to exploit vulnerabilities almost immediately after their disclosure, maintaining aggressive patch management practices is essential. Organizations may also consider temporarily disabling or limiting access to vulnerable systems until those patches can be effectively applied.
In summary, the evolving tactics of Storm-1175 underscore the pressing need for organizations to enhance their cybersecurity posture through proactive measures, diligent monitoring, and rapid response strategies. The quick adaptation of threat actors like Storm-1175 highlights the ongoing cyber risks that organizations face, necessitating a committed and swift approach to vulnerability management.