New StormEncryptor ransomware used by former Medusa affiliate

The investigation began with a report linking a new ransomware family to a former Medusa affiliate and to CVE-2026-18577. Vendor, NVD and CISA records independently established the vulnerability's mechanism, affected N-central releases, fixed build and confirmed exploitation, while the earlier CVE record explained why a second identifier was issued. The ransomware attribution and post-compromise sequence remain credible reporting rather than fully independently reproduced findings, and no credible public exploit code was verified.

1. What event and claims require verification?
   Reviewed the supplied StormEncryptor report and separated its campaign claims from the N-central vulnerability evidence.
   bleepingcomputer.com ↗

   The report attributes StormEncryptor deployment to Storm-1175 and says exploitation of CVE-2026-18577 likely preceded the intrusions.

   why This established the campaign hypothesis but required primary confirmation of exploitation, affected versions and remediation.

2. Did Microsoft publish a directly searchable advisory supporting the campaign account?
   Searched the Microsoft Security Blog for StormEncryptor.

   The search returned no matching conventional blog article.

   why The absence of a directly reviewable article limits independent verification of the detailed attribution and malware observations.

3. What is CVE-2026-18577 and what does it permit?
   Reviewed the National Vulnerability Database record.
   nvd.nist.gov ↗

   NVD describes an incomplete patch that permits authentication bypass and account takeover in N-central, assigns CVSS 8.1 and identifies the entry as present in CISA's exploited-vulnerability catalogue.

   why This independently confirms the security boundary affected and the high-impact outcome without relying on the ransomware report.

4. Which release contains the vendor's mitigation?
   Reviewed N-able's N-central 2026.3 HF1 release notes.
   documentation.n-able.com ↗

   N-able identifies build 2026.3.1.7, dated 2 August 2026, as containing the mitigation for CVE-2026-18577.

   why This provides the specific upgrade target defenders need.

5. What exposure guidance and compromise indicators did the vendor publish?
   Reviewed N-able's hotfix and mitigation notice.
   status.n-able.com ↗

   N-able says instances not running the hotfix require urgent upgrading, distinguishes hosted from self-hosted deployments and lists svchost.exe in user Documents folders, a Cloudflared service and several IP addresses as indicators to investigate.

   why This turns the vulnerability finding into concrete remediation and threat-hunting actions.

6. Is exploitation confirmed rather than merely predicted or technically possible?
   Reviewed the filtered CISA Known Exploited Vulnerabilities entry.
   cisa.gov ↗

   CISA lists CVE-2026-18577 as exploited in the wild, added it on 3 August 2026 and describes the weakness as authentication bypass leading to account takeover.

   why CISA provides authoritative confirmation of active exploitation, independently of probability scores and campaign reporting.

7. Is credible public PoC or exploit code available?
   Searched GitHub repositories for the exact CVE identifier and inspected the only repository presented as a CVE-specific draft.
   github.com ↗

   The repository contained generic template material and donation content but no verified CVE-specific exploit implementation.

   why A repository name alone is not evidence of a working PoC, so PoC availability remains unconfirmed.

8. How does CVE-2026-18556 relate to this event?
   Reviewed the earlier vulnerability's NVD record.
   nvd.nist.gov ↗

   CVE-2026-18556 is the original N-central alternate-path authentication bypass affecting versions through 2026.1; CVE-2026-18577 addresses the incomplete fix.

   why This confirms that both identifiers are related while distinguishing the currently reported bypass from its predecessor.