N-able shipped the emergency hotfix for CVE-2026-18577 on August 2. Storm-1175 shipped its first StormEncryptor ransomware deployment the same day. According to Microsoft Threat Intelligence, the group began running the new payload against N-central customers within hours of the same authentication-bypass flaw the patch closed, using it as the front door into every managed endpoint the console controlled. Red Hound flagged this exact bug as an active-exploitation risk on August 4; eight days later it is a confirmed ransomware entry point, not a theoretical one.
This affects you if you run N-central, self-hosted or cloud, whether directly or because an MSP manages your endpoints through it. If Storm-1175 or anyone using the same bypass reached your console between public disclosure and the moment you applied build 2026.3.1.7, patching now closes the door but does not tell you whether someone already walked through it. If you have never run N-central and never will, the pattern below is still worth five minutes: a single RMM console can ransomware every business it touches, and that lesson outlives this specific CVE.
Storm-1175 traded Medusa for a payload of its own
Storm-1175 is the actor Microsoft has tracked since 2024 weaponizing freshly disclosed vulnerabilities in internet-facing management software: GoAnywhere MFT, SmarterMail, on-prem Exchange, Ivanti Connect Secure, JetBrains TeamCity. Its usual finishing move was deploying someone else's ransomware-as-a-service, most recently Medusa. StormEncryptor is the first payload Microsoft has attributed to the group as its own build, and its debut lands squarely on the N-central bypass. Storm-1175 had gone quiet in Microsoft's telemetry since April; this is the group's return, running its own tooling, on a bug that was less than a day old in the wild when it already had a working exploit chain.
What StormEncryptor does once it is in
The payload is a C++ binary that appends .encrypted to every file it touches and drops !!!README_FIRST!!!.txt in each scanned directory, giving victims three days to negotiate before the group threatens to leak the stolen data. Before encryption, Storm-1175's operators lean on N-central's own Take Control feature or a dropped copy of AnyDesk or SimpleHelp to move around the network, run Advanced IP Scanner to map what else is reachable, and pull credentials out of LSASS with Mimikatz. None of that toolkit is novel. What is new is the entry point: an RMM console built to reach every managed endpoint at once, doing exactly that for an attacker instead of a technician.
Patched on day one does not mean day one was clean
N-able's own advisory confirms the August 2 hotfix build is 2026.3.1.7. Huntress telemetry found more than half of monitored N-central cloud servers still unpatched a full day after the fix shipped, and CISA's KEV listing for CVE-2026-18577 confirms active exploitation independent of any single vendor's numbers. The build number in your admin panel proves you closed the door. It does not prove nobody walked through it first. That gap is a compromise-assessment question, not a patch-management checkbox, and it is the step most teams skip once a CVE stops trending.
What to check on every N-central-managed endpoint right now
Three things to look for today
- Confirm every N-central instance you run or rely on, self-hosted and cloud, is on build
2026.3.1.7or later. - Hunt for Storm-1175's published indicators on the endpoints the console manages, not just on the console itself.
- Rotate the credentials of any N-central technician account before you assume the environment is clean.
# Hunt for Storm-1175 / StormEncryptor indicators on N-central-managed
# endpoints. Deploy via N-central script push or your own RMM/EDR tooling.
# 1. svchost.exe running outside its legitimate System32 path
Get-CimInstance Win32_Process -Filter "Name='svchost.exe'" |
Where-Object { $_.ExecutablePath -notlike 'C:\Windows\System32\*' } |
Select-Object ProcessId, ExecutablePath, ParentProcessId
# 2. A "Cloudflared" service nobody on the team deployed intentionally
Get-CimInstance Win32_Service -Filter "Name='Cloudflared'" |
Select-Object Name, PathName, StartName, State
# 3. Ransom note or encrypted-file markers already on disk
Get-ChildItem -Path C:\Users -Recurse -Filter '!!!README_FIRST!!!.txt' -ErrorAction SilentlyContinue
Get-ChildItem -Path C:\Users -Recurse -Filter '*.encrypted' -ErrorAction SilentlyContinue |
Select-Object FullName -First 5None of these three checks require buying anything. They require running them today, on every endpoint the compromised console could reach, not just the console itself.
Confirm the patch, then hunt for what Storm-1175 already dropped
Patch verification is a five-minute task. The hunt above is the part most organizations skip once a CVE stops trending, and it is the only way to answer whether you were exposed during the window Storm-1175 was already using this bug. Run it on every endpoint your N-central console reaches, not just the console itself. If you manage other people's environments through N-central or any other RMM, treat this as the reminder: the console's blast radius is every client behind it. A compromise assessment run this week costs an afternoon. Skipping it and finding out later costs the incident response engagement, the notification letters, and the client relationships that do not survive a shared ransom note.
Not sure whether Storm-1175 got in before you patched?
We run compromise assessments for organizations that patched a known-exploited RMM or edge bug and want to know whether the gap between disclosure and patching left something behind. Book a session to scope a review of your N-central-managed environment.