Storm-1175

Mentions · 7d0
Mentions · 30d0
All mentions3
First seenAug 12, 2026
Last mentionedAug 18, 2026

Timeline

3 articles · newest first

Medusa ransomware tallies hundreds of new victims, says updated advisory on group’s tactics

CISA, FBI, and HHS updated their Medusa ransomware advisory, reporting over 500 victims and detailing the gang's access-broker and exploit tactics.

CyberScoopAug 18, 17:19 UTC · Aug 18, 2026RansomwareExploited1

Storm-1175 Replaces Medusa With New StormEncryptor Ransomware

Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.

Security AffairsAug 13, 08:09 UTC · Aug 13, 2026RansomwareExploitedCVE-2026-18577 CVE-2026-1731 CVE-2023-21529+153 · 1 read

N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577

N-able shipped a second N-central hotfix as attackers actively exploit authentication bypass CVE-2026-18577, attributed to ransomware group Storm-1175.

Help Net SecurityAug 12, 06:48 UTC · Aug 12, 2026Exploit / PoCExploitedCVE-2026-18577 CVE-2026-185563 · 1 read

Related CVEs

by mentions

CVE-2026-1857715%8.2
Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
published Aug 2, 2026N-able N-centralKEV
CVE-2025-5269186%10.0
Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail
published Dec 29, 2025SmarterTools SmarterMailKEVRansomwarePoC ×2
CVE-2025-31161100%9.8
Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
published Apr 3, 2025CrushFTPKEVRansomwarePoC ×5
CVE-2026-2376096%9.3
Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail
published Jan 22, 2026SmarterTools SmarterMailKEVRansomwarePoC ×2
CVE-2023-2152959%8.8
Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529)
published Feb 14, 2023Microsoft Exchange ServerKEVRansomware
CVE-2024-170895%8.4
Path Traversal RCE in ConnectWise ScreenConnect (CVE-2024-1708)
published Feb 21, 2024ConnectWise ScreenConnectKEVRansomwarePoC
CVE-2023-46805100%8.2
Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
published Jan 12, 2024Ivanti Connect Secure (ICS, formerly Pulse Connect Secure)KEVRansomwarePoC
CVE-2024-5772797%7.5
Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
published Jan 15, 2025SimpleHelp (remote support/remote access software)KEVRansomware
CVE-2024-27199100%7.3
Path Traversal in JetBrains TeamCity Allows Limited Admin Actions
published Mar 4, 2024JetBrains TeamCityKEVRansomwarePoC
CVE-2024-5772864%7.2
Zip-Slip Path Traversal RCE in SimpleHelp Remote Support 5.5.7 and Earlier
published Jan 15, 2025SimpleHelp (remote support/RMM software)KEVRansomware

Appears with

StormEncryptormalware · 2
SimpleHelpproduct · 2
AnyDeskproduct · 2
CISAorganization · 2
N-ablevendor · 2
Microsoftvendor · 2
Medusamalware · 2
Microsoft Threat Intelligenceorganization · 1
Sophosvendor · 1
Mimikatzproduct · 1
FBIorganization · 1
Medusathreat actor · 1
Advanced IP Scannerproduct · 1
Fortravendor · 1
Impacketproduct · 1
Huntressorganization · 1

Entities are extracted by the model from each article. First seen Aug 12, 2026, last mentioned Aug 18, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.