StormEncryptor

Mentions · 7d0
Mentions · 30d0
All mentions2
First seenAug 12, 2026
Last mentionedAug 13, 2026

Timeline

2 articles · newest first

Storm-1175 Replaces Medusa With New StormEncryptor Ransomware

Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.

Security AffairsAug 13, 08:09 UTC · Aug 13, 2026RansomwareExploitedCVE-2026-18577 CVE-2026-1731 CVE-2023-21529+153 · 1 read

N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577

N-able shipped a second N-central hotfix as attackers actively exploit authentication bypass CVE-2026-18577, attributed to ransomware group Storm-1175.

Help Net SecurityAug 12, 06:48 UTC · Aug 12, 2026Exploit / PoCExploitedCVE-2026-18577 CVE-2026-185563 · 1 read

Related CVEs

by mentions

CVE-2026-1857715%8.2
Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
published Aug 2, 2026N-able N-centralKEV
CVE-2025-5269186%10.0
Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail
published Dec 29, 2025SmarterTools SmarterMailKEVRansomwarePoC ×2
CVE-2025-31161100%9.8
Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
published Apr 3, 2025CrushFTPKEVRansomwarePoC ×5
CVE-2026-2376096%9.3
Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail
published Jan 22, 2026SmarterTools SmarterMailKEVRansomwarePoC ×2
CVE-2023-2152959%8.8
Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529)
published Feb 14, 2023Microsoft Exchange ServerKEVRansomware
CVE-2024-170895%8.4
Path Traversal RCE in ConnectWise ScreenConnect (CVE-2024-1708)
published Feb 21, 2024ConnectWise ScreenConnectKEVRansomwarePoC
CVE-2023-46805100%8.2
Authentication Bypass in Ivanti Connect Secure and Policy Secure Web Component
published Jan 12, 2024Ivanti Connect Secure (ICS, formerly Pulse Connect Secure)KEVRansomwarePoC
CVE-2024-5772797%7.5
Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
published Jan 15, 2025SimpleHelp (remote support/remote access software)KEVRansomware
CVE-2024-27199100%7.3
Path Traversal in JetBrains TeamCity Allows Limited Admin Actions
published Mar 4, 2024JetBrains TeamCityKEVRansomwarePoC
CVE-2024-5772864%7.2
Zip-Slip Path Traversal RCE in SimpleHelp Remote Support 5.5.7 and Earlier
published Jan 15, 2025SimpleHelp (remote support/RMM software)KEVRansomware

Appears with

AnyDeskproduct · 2
SimpleHelpproduct · 2
Storm-1175threat actor · 2
Medusamalware · 2
Microsoftvendor · 2
N-ablevendor · 2
Advanced IP Scannerproduct · 1
Impacketproduct · 1
Huntressorganization · 1
Sophosvendor · 1
CISAorganization · 1
PDQ Deployproduct · 1
N-centralproduct · 1
Sophosorganization · 1
Take Controlproduct · 1
Microsoft Threat Intelligenceorganization · 1

Entities are extracted by the model from each article. First seen Aug 12, 2026, last mentioned Aug 13, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.