INC affiliates left servers open, exposing AI-assisted ransomware operations
SOCRadar says open directories led to six more servers, 8,257 AI messages, and 46 INC encryptor builds.
72
Product
SimpleHelp
- Mentions · 7d0
- Mentions · 30d1
- All mentions8
- First seenAug 12, 2026
- Last mentioned9d ago
Timeline
8 articles · newest firstAttackers plant remote access tools on compromised PaperCut servers
Attackers chained two PaperCut NG/MF zero-days for unauthenticated access, installing SimpleHelp and AnyDesk remote access tools on compromised servers.
78
SimpleHelp OpenID Connect Auth Bypass to RCE [CVE-2026-48558]
Metasploit adds a module chaining SimpleHelp OpenID Connect authentication bypass to remote code execution, tracked as CVE-2026-48558.
48
Attackers Exploit Critical Langflow and Rails Flaws in Credential
VulnCheck reports active exploitation of critical Langflow CVE-2026-0768 and Rails CVE-2026-66066 for credential harvesting, with detections rising to 360.
88
Medusa ransomware gang has hit over 500 organizations, CISA warns
FBI, CISA, and HHS warn Medusa ransomware has hit over 500 organizations across critical infrastructure since June 2021, using phishing and unpatched flaws.
75
More than 200 victims of Medusa ransomware identified over the last year, CISA says
CISA and FBI update Medusa ransomware advisory, reporting more than 500 total victims and warning the gang operationalizes newly disclosed exploits within 24 hours.
70
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
62
N-able ships second N-central hotfix as attackers keep exploiting CVE-2026-18577
N-able shipped a second N-central hotfix as attackers actively exploit authentication bypass CVE-2026-18577, attributed to ransomware group Storm-1175.
78
Related CVEs
by mentions- CVE-2026-1857715%8.2Authentication Bypass and Account Takeover in N-able N-central (Incomplete Patch)
- CVE-2024-5772797%7.5Unauthenticated Path Traversal File Download in SimpleHelp 5.5.7 and Earlier
- CVE-2025-3248100%9.8Unauthenticated RCE in Langflow /api/v1/validate/code
- CVE-2025-31161100%9.8Authentication Bypass in CrushFTP File Transfer Servers (CVE-2025-31161)
- CVE-2026-3561694%9.8Unauthenticated Code Execution in Fortinet FortiClient EMS 7.4.5–7.4.6
- CVE-2026-4855878%9.5Authentication Bypass via Forged OIDC Tokens in SimpleHelp
- CVE-2026-2376096%9.3Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2024-170895%8.4Path Traversal RCE in ConnectWise ScreenConnect (CVE-2024-1708)
- CVE-2024-27199100%7.3Path Traversal in JetBrains TeamCity Allows Limited Admin Actions
Appears with
- AnyDeskproduct · 5
- CISAorganization · 3
- Microsoftvendor · 3
- Medusamalware · 2
- FBIorganization · 2
- StormEncryptormalware · 2
- SimpleHelpvendor · 2
- Storm-1175threat actor · 2
- Rapid7vendor · 2
- N-ablevendor · 2
- Medusathreat actor · 2
- PaperCut MFproduct · 1
- VulnCheckvendor · 1
- Ateraproduct · 1
- Unknownthreat actor · 1
- US, Germany, Malaysia, Brazil, India Langflow hostsvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.