60
60
60
60
60
60
60
60
47
60
CISA orders federal agencies to disconnect Ivanti VPN instances by February 2
60
35
Two Ivanti Zero
60
60
60
47
New Ivanti Vulnerability Observed as Widespread Security Concerns Grow
60
60
Warning: New Ivanti Auth Bypass Flaw Affects Connect Secure and ZTA Gateways
60
60
U.S. Cybersecurity Agency Warns of Actively Exploited Ivanti EPMM Vulnerability
60
35
60
Week in review: GitLab account takeover flaw, attackers exploiting Ivanti Connect Secure zero-days
60
60
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
Microsoft Threat Intelligence reports that the financially motivated, China-linked group Storm-1175 began deploying a new ransomware strain called StormEncryptor on August 2, 2026, replacing its previous Medusa ransomware. StormEncryptor is written in C++, appends the .encrypted extension to files, and drops a !!!README_FIRST!!!.txt ransom note in each scanned directory. Microsoft assesses the group is likely exploiting CVE-2026-18577, an authentication bypass in N-able disclosed on August 2, 2026 and added to CISA's Known Exploited Vulnerabilities catalog the next day. Since 2023, Storm-1175 has exploited more than 16 vulnerabilities in products including Microsoft Exchange, Ivanti, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, and GoAnywhere MFT, often moving from initial access to data theft and ransomware deployment within days.
62
60
Fast-moving Storm-1175 uses new exploits to breach networks and drop Medusa
60
60
60
60
60
60
60
Google Reports 75 Zero-Days Exploited in 2024 — 44% Targeted Enterprise Security Products
60
60
60
60
Ivanti VPN customers targeted via unrecognized RCE vulnerability (CVE-2025-22457)
60
60