Storm-1175

actor · actor:storm-1175 single-source

Financially motivated ransomware actor that Microsoft Threat Intelligence links to China and which it previously described as running high-velocity ransomware campaigns exploiting recently disclosed and zero-day flaws in internet-facing software, in some cases a week before public disclosure, moving from initial access to full encryption in under 24 hours. It used Medusa ransomware against healthcare, professional services and finance organisations in Australia, Britain and the United States; from 2 August 2026 Microsoft observed it deploying a new strain, StormEncryptor, and assesses it is likely exploiting CVE-2026-18577 in N-able N-central, without formally confirming the access vector (Microsoft Threat Intelligence via The Record, 2026-08-10).

Coverage

2 about it · 1 mention · first 2026-08-03 → last 2026-09-07

Latest activity

2026-09-07

Insikt Group: the same six-tool stack followed thirteen unrelated CVEs into Exchange, SharePoint, FortiOS…

Peak priority

critical

1 critical · 1 notable

Targets

technology

sectors: technology, public-sector, healthcare · regions: europe

Sources cited

11 hosts

2026-08-033 appearances2026-09-07

Action items (7)

Do-now tasks recorded on the entries about Storm-1175, newest first. Check the date before acting on an older one.

Immediate action: N-able states an attacker obtained remote administrative access on every N-central server below build 2026.3.1.7 and used the console's Take Control feature to connect to managed systems, registering a Cloudflare tunnel service on them for persistence that outlives the loss of N-central access. The first emergency fix was bypassable, so upgrading to 2026.3 is not sufficient, only 2026.3.1.7 closes it. N-able states hosted instances will have the upgrade applied automatically and that those customers will be notified of their server's upgrade schedule. Patch self-hosted servers immediately, restrict the console to known networks, and treat any instance that was internet-reachable since 31 July as a compromise-assessment target: the patch does not remove a tunnel already registered on a downstream endpoint.
2026-08-03CVE-2026-18577 +1
Upgrade every self-hosted N-able N-central server to build 2026.3.1.7, the 2026.3 upgrade N-able recommended on 1 August does not close CVE-2026-18577. N-able states the upgrade will be applied automatically to hosted instances on a schedule those customers are notified of, so confirm yours has actually landed rather than assuming it.
2026-08-03CVE-2026-18577 +1
For any N-central instance reachable from untrusted networks since 31 July, review console sign-in and Take Control session logs for administrative sessions and remote-control connections that match no ticket, and check the endpoints those sessions touched for a service registered as Cloudflared and for an svchost.exe under a user's Documents folder, the two artifacts N-able names, the tunnel outlives the patch.
2026-08-03CVE-2026-18577 +1
On every N-central server that ran below 2026.3.1.7 while internet-reachable, hunt for the named artefacts rather than closing the ticket on the hotfix: accounts created around the exposure window, a renamed tunnelling client running under a Microsoft-update filename, and a kernel driver staged under a remote-support tool's ProgramData directory.
2026-08-03CVE-2026-18577 +1
Sweep managed endpoints for any remote-monitoring agent the organisation did not provision; a second RMM tool on a host is high-fidelity on its own, whichever product it is.
2026-08-03CVE-2026-18577 +1

2 older action items

Upgrade on-premises N-central to 2026.3.1.10 even where 2026.3.1.7 was already applied; the vendor states Hotfix 2 is required regardless and supersedes Hotfix 1; hosted NCOD instances need no action.
2026-08-03CVE-2026-18577 +1
Extend the compromise assessment from the N-central server to the endpoints it manages, looking specifically for a newly registered service running a Cloudflare Tunnel client, which the vendor reports survives revocation of access to the N-central server.
2026-08-03CVE-2026-18577 +1

Defender insights

What each entry about Storm-1175 tells a defender to do, newest first.

2026-09-07NOTABLEInsikt Group: the same six-tool stack followed thirteen unrelated CVEs into Exchange, SharePoint, FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer and Apache Shiro

2026-08-03CRITICALexploitedN-able hotfixes an exploited N-central auth bypass after its earlier fix proved bypassable

Latest update · triage

Triage

The vendor's published network indicators are not a safe discriminator on their own. Huntress found that "the four IPs N-able initially flagged as malicious are actually Mullvad or NordVPN VPN exit nodes" (Huntress, 2026-08-03), shared commercial infrastructure that ordinary users and unrelated traffic also originate from, so a match is a prompt to investigate the session, never a finding in itself. Take Control log files under GetSupportService_N-Central\Logs\ are not themselves evidence of compromise; Huntress is explicit that "these logs are also created during legitimate Take Control usage" (Huntress, 2026-08-03), so they are a pivot rather than a detection. The discriminators are the surrounding facts: whether the session maps to a ticket or technician, whether the viewer identity is one of your own staff, the criticality of the target host, and the time of day. A service registered as Cloudflared, or an svchost.exe under a user's Documents folder, is the sharper signal; a remote-support session that legitimately used Take Control has no reason to leave either behind (N-able status page, 2026-08-02).

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

uses

StormEncryptor
malwaremalware:stormencryptorevidence · 2026-08-03
Microsoft Threat Intelligence reports Storm-1175 began deploying StormEncryptor on 2 August 2026

Story timeline

Every entry that names Storm-1175, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

2026-09-07Recorded Future's H1 2026 Malware and Vulnerability Trends: two clusters reuse an identical post-exploitation tool stack across thirteen and ten unrelated initial CVEs
researchInsikt Group: the same six-tool stack followed thirteen unrelated CVEs into Exchange, SharePoint, FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer and Apache Shiro
2026-09-07CVE-2026-86206 / CVE-2026-86207 / CVE-2026-86218, N-able N-central: a third, unrelated auth-bypass/RCE chain in five weeks, the third CVE a pre-auth CVSS 10.0 zero-day N-able says is already exploited
mentiondeep-diveN-able ships a fourth emergency hotfix in a month after a fully patched N-central server was compromised again through a brand-new flaw
2026-08-03CVE-2026-18556 / CVE-2026-18577, N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable
trending-vulnerabilitiesN-able hotfixes an exploited N-central auth bypass after its earlier fix proved bypassable

Hunting pivots

CVEs (exploited first)

CVE-2026-18556 CVE-2026-18577

Affected products

Apache Shiro Cisco IOS XE F5 BIG-IP Fortinet FortiOS GeoServer Microsoft Exchange Server Microsoft SharePoint N-able N-central

Initial Access TA0001

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Execution TA0002

T1059.001Command and Scripting Interpreter: PowerShell×1

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. PowerShell can also be installed on Linux and macOS. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

T1059.003Command and Scripting Interpreter: Windows Command Shell×1

Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

T1072Software Deployment Tools×1

Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Persistence TA0003

T1136.002Create Account: Domain Account×1

Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

T1505.003Server Software Component: Web Shell×1

Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

T1543.003Create or Modify System Process: Windows Service×1

Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Privilege Escalation TA0004

T1543.003Create or Modify System Process: Windows Service×1

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Stealth TA0005

T1036.005Masquerading: Match Legitimate Resource Name or Location×1

Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Defense Impairment TA0112

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Discovery TA0007

T1082System Information Discovery×1

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

T1087.002Account Discovery: Domain Account×1

Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

T1518.001Software Discovery: Security Software Discovery×1

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Lateral Movement TA0008

T1072Software Deployment Tools×1

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

Command and Control TA0011

T1071.001Application Layer Protocol: Web Protocols×1

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

T1105Ingress Tool Transfer×1

Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

T1219Remote Access Tools×1

An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

T1219.002Remote Access Tools: Remote Desktop Software×1

An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software tools, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

T1572Protocol Tunneling×1

Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Exfiltration TA0010

T1041Exfiltration Over C2 Channel×1

Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Evidence: 2026-09-07/recordedfuture-h1-2026-tool-stack-reuse · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-08-03/cve-2026-18577-n-able-n-central-auth-bypass-exploited · ATT&CK page ↗

Entries about Storm-1175 (2)

2026-09-07 · view entry permalink →

NOTABLENATOB2

Recorded Future's H1 2026 Malware and Vulnerability Trends: two clusters reuse an identical post-exploitation tool stack across thirteen and ten unrelated initial CVEs

Recorded Future's Insikt Group published its H1 2026 Malware and Vulnerability Trends report on 3 September 2026, tracking 215 actively exploited CVEs in the first half of 2026, up 34% from 161 in H1 2025 (Recorded Future, 2026-09-03). Of those, 176 (82%) were network-accessible and 146 (68%) could be exploited without prior authentication; 142 of those 146 combined both properties, and 60 of 82 remote-code-execution CVEs combined network reachability, no authentication requirement and code execution in a single package (Recorded Future, 2026-09-03).

The report's most actionable finding for defenders is that post-exploitation tool-stack reuse persists across otherwise-unrelated initial-access vulnerabilities, regardless of vendor or product family (Recorded Future, 2026-09-03). A cluster the report designates StrikeShark applied an identical six-tool post-exploitation stack (SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer and SharpGPOAbuse) across thirteen separate CVEs spanning 2016 through 2025, reaching Microsoft Exchange, Microsoft SharePoint, Fortinet FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer and Apache Shiro (Recorded Future, 2026-09-03); SharkLoader itself was previously profiled by Kaspersky's GReAT, which found it deploying Cobalt Strike via "Perfect DLL Hijacking" in a campaign whose confirmed victims spanned government and diplomatic entities, software developers and organizations in several other sectors and regions (Kaspersky Securelist, 2026-06-24). Separately, Storm-1175 linked Mimikatz, Impacket, PsExec, Rclone and Medusa ransomware across ten different initial CVEs; a China-linked cluster the report designates SHADOW-EARTH-053 separately reused Mimikatz following exploitation of CVE-2021-26855 in Microsoft Exchange Server (Recorded Future, 2026-09-03). Insikt Group mapped 114 of the 215 CVEs to MITRE ATT&CK: exploitation of a public-facing application was associated with 77 CVEs (68%), and 50 of those 77 also co-occurred with PowerShell, Windows Command Shell or Unix Shell execution; every one of the 28 web-shell-associated CVEs also carried the public-facing-application technique. The next most frequently associated post-exploitation behaviors across the mapped CVEs were system-information discovery, collection of data from the local system, transfer of further tooling into the compromised environment, and exfiltration over the command-and-control channel or web-protocol-based C2 traffic (Recorded Future, 2026-09-03).

The report's own defender-facing conclusion is explicit: because the same limited tool stack recurs regardless of which vulnerability supplied the initial foothold, detection engineering should chain exploitation telemetry from public-facing systems through to the post-exploitation behaviors these clusters repeat (credential dumping, remote-service execution via native administration mechanisms, bulk outbound data transfer, and ransomware staging) rather than treating each CVE alert as an isolated, one-off event (Recorded Future, 2026-09-03).

Threat actors reused post-exploitation playbooks across different initial vulnerabilities; StrikeShark applied the same six-tool stack across thirteen CVEs, while Storm-1175 linked credential theft, remote execution, data transfer, and ransomware tooling across ten.

In the StrikeShark campaign, SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer, and SharpGPOAbuse were linked to the same thirteen CVEs. Those vulnerabilities spanned 2016 through 2025 and affected Microsoft Exchange and SharePoint, Fortinet FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer, Apache Shiro, and other public-facing technologies.

50 of the 77 CVEs associated with the exploitation of public-facing applications were also linked to PowerShell, Windows Command Shell, or Unix Shell, and all 28 web-shell-associated CVEs also included T1190.

Recorded Future (Insikt Group) 2026-09-03

Builds on: Kaspersky GReAT: "StrikeShark" loader deploys Cobalt Strike via "Perfect DLL Hijacking" against…

annual-report07 Sep 04:43Zsingle-sourceOpen finding →

Sources: Recorded Future (Insikt Group) · Kaspersky Securelist (GReAT)

2026-08-03 · view entry permalink →

CRITICALCVE-2026-18577 +1exploitedupdatedNATOA1

CVE-2026-18556 / CVE-2026-18577, N-able N-central: unauthenticated admin access to the RMM console, exploited in the wild, and the day-one fix was itself bypassable

N-able disclosed and then re-patched a critical authentication bypass in N-central, the remote monitoring and management platform managed service providers use to monitor, patch and remotely access customer estates. The vendor's own account of the attack is that "an attacker had identified a vulnerability on all N‑central servers running a version prior to 2026.3.1.7, which allowed them to obtain administrative access remotely" (N-able, 2026-08-02). The sequence matters as much as the flaw. N-able first addressed the issue in 2026.2 and, on 1 August, told customers still on older builds to move to 2026.3 as an immediate protective measure (N-able, 2026-08-02); its initial advisory tied the exploitation to CVE-2026-18556, while the hotfix that followed pointed at CVE-2026-18577 (Huntress, 2026-08-03). What changed in between is that the vendor "identified an alternative method to exploit this vulnerability, which was not mitigated in our previous fix" (N-able, 2026-08-02). Huntress records the second identifier's published description as "an incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1" (Huntress, 2026-08-03). Hotfix build 2026.3.1.7 shipped the same afternoon (N-able status page, 2026-08-02). One discrepancy in the vendor's own material is worth resolving before you scope your estate: the status notice describes the issue as affecting every N-central instance not running 2026.3.1, while the security blog says the attacker reached all servers "running a version prior to 2026.3.1.7" and the published CVE description gives the affected range as through 2026.3.1. The blog and the CVE record agree with each other, so 2026.3.1 is affected and 2026.3.1.7 is the fixed build, for anyone sitting on 2026.3.1 the single digit is the whole decision.

N-able dates the start of the visible signal precisely: "On July 31, 2026, N‑able saw an increase in licensing issues for our on-premises N‑central customers", the anomaly that put its engineering and security teams on the investigation (N-able, 2026-08-02), which is why 31 July is the sensible left edge for scoping a look-back. Exploitation is confirmed but so far bounded: N-able says "A limited number of customers have been identified to be impacted" (N-able, 2026-08-02), and Huntress reports it "has seen exploitation impacting one organization in our customer base" as of publication (Huntress, 2026-08-03). What removes the comfort from those numbers is the blast radius of the product: Huntress states that "a compromised N-central server can be used to run scripts, push tools, and open remote sessions across every downstream endpoint it manages", including domain controllers, and that an attacker in the console can also create administrative accounts and loosen security-relevant policy (Huntress, 2026-08-03). The observed post-exploitation path is the platform's own tooling rather than malware: N-able records that "the attacker leveraged the Take Control feature and connected to systems within the N‑central managed environment" and that on those devices "the attackers registered a new service for a CloudFlare tunnel, enabling persistence into an environment after access to the N‑central server was revoked" (N-able, 2026-08-02).

Two facts from an update Huntress added on 3 August shape how any of this can actually be hunted. First, the platform's exposure is worse than the confirmed-victim count suggests: at the time of that update "more than half (55.6%) of our partners' and customers' reachable cloud servers were still unpatched" (Huntress, 2026-08-03). Second, the compromised asset is itself a telemetry gap; Huntress notes that "the N-able server runs a custom distribution of AlmaLinux 9, and does not often have EDR software deployed on it due to running as an appliance" (Huntress, 2026-08-03), so the endpoint agent that would normally carry this investigation is frequently absent from the one host that matters most. Detection therefore leans on the server's own application logs and on what the pivot leaves behind downstream. In web-application and authentication logs on the N-central server itself, the signal is administrative activity and remote-control sessions with no corresponding legitimate credential use, Huntress points defenders at the console's UI and remote-access logs and flags sessions whose viewer account presents as a vendor support identity, or that target domain controllers and file servers, or that fall outside the team's working pattern. On managed Windows endpoints, Take Control leaves log files under C:\ProgramData\GetSupportService_N-Central\Logs\, and in service-installation telemetry the durable artifact is an unexpected service registered under the name Cloudflared, and in file-system terms a binary named svchost.exe sitting in a user's Documents folder, both named by N-able as the things to look for on a device you suspect (N-able status page, 2026-08-02). The second is worth dwelling on: the real Windows service host only ever runs from the system directories, so that filename anywhere under a user profile is anomalous by construction. In egress telemetry the signal is outbound tunnel traffic from hosts that have no business originating it. Because the console bypass needs no credentials, Huntress advises that an N-central server still broadly reachable from the internet or other untrusted networks should be considered for temporary shutdown until the hotfix is applied and it can be returned behind strict network controls (Huntress, 2026-08-03).

Triage: the vendor's published network indicators are not a safe discriminator on their own. Huntress found that "the four IPs N-able initially flagged as malicious are actually Mullvad or NordVPN VPN exit nodes" (Huntress, 2026-08-03), shared commercial infrastructure that ordinary users and unrelated traffic also originate from, so a match is a prompt to investigate the session, never a finding in itself. Take Control log files under GetSupportService_N-Central\Logs\ are not themselves evidence of compromise; Huntress is explicit that "these logs are also created during legitimate Take Control usage" (Huntress, 2026-08-03), so they are a pivot rather than a detection. The discriminators are the surrounding facts: whether the session maps to a ticket or technician, whether the viewer identity is one of your own staff, the criticality of the target host, and the time of day. A service registered as Cloudflared, or an svchost.exe under a user's Documents folder, is the sharper signal; a remote-support session that legitimately used Take Control has no reason to leave either behind (N-able status page, 2026-08-02).

an attacker had identified a vulnerability on all N‑central servers running a version prior to 2026.3.1.7

we identified an alternative method to exploit this vulnerability, which was not mitigated in our previous fix

the attackers registered a new service for a CloudFlare tunnel, enabling persistence into an environment after access to the N‑central server was revoked

N-able 2026-08-02

Exploitation is active in the wild; a compromised N-central server can be used to run scripts, push tools, and open remote sessions across every downstream endpoint it manages.

N-able's initial security advisory linked this critical vulnerability to CVE-2026-18556; while the subsequent hotfix pointed to CVE-2026-18577.

Huntress 2026-08-03

the threat actor used the compromised N-central server to access high-value endpoints such as a backup server, domain controllers, and application servers

the PhantomKiller endpoint detection and response (EDR) evasion tool loaded a driver named k.sys, which was located in C:\\ProgramData\\AnyDesk

Sophos X-Ops (Counter Threat Unit) 2026-08-04

based on evidence of active exploitation

CISA 2026-08-04

This is not a duplicate of our previous communication; Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers.

N-able 2026-08-02

Upon gaining access to those devices, the threat actors registered a new service for a Cloudflare Tunnel, enabling persistence even after access to the N‑central server was revoked.

The Hacker News 2026-08-08

the Storm-1175 group began deploying a new ransomware strain on August 2 called StormEncryptor

Microsoft has not formally confirmed the access vector, but noted that StormEncryptor deployments began the same day the flaw was disclosed.

The Record (Recorded Future News) 2026-08-10

Update05 Aug 2026 04:12 UTCrun 2026-08-05T0412Z-intelactionscvesentitiesevidenceregionssectorssourcestagstechniquesbody

Two developments turn the N-able N-central authentication bypass from a patching task into a compromise-assessment task. CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog on 2026-08-04, based on evidence of active exploitation (CISA, 2026-08-04). More usefully, Sophos X-Ops has published what the actor did after taking the console (Sophos X-Ops, 2026-08-04), the original coverage described the flaw and the incomplete first fix, but not the post-exploitation chain, and that chain is what determines whether the hotfix was sufficient.

On the management server itself, the actor created a new domain account under a backup-product name, reset existing administrator credentials, and enumerated accounts, domain-administrator group membership and installed security products before moving on (Sophos X-Ops, 2026-08-04). The reconnaissance is unremarkable; the account creation and credential reset are not, because they survive the platform being patched.

The console was then used as a distribution channel. Sophos records six different remote-monitoring-and-management tools pushed from the compromised N-central console onto reachable endpoints (AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp and HopToDesk) establishing remote access that no longer depends on N-central at all (Sophos X-Ops, 2026-08-04). That is the structural point for anyone who patched and moved on: the entry point was closed, and six independent ways back in were already in place. Alongside them a Cloudflare Tunnel client was deployed and renamed to a Microsoft-update-styled filename, giving persistent outbound tunnelling that blends into ordinary update traffic by name, and a kernel driver Sophos names PhantomKiller was loaded from a remote-support tool's ProgramData directory as an endpoint-detection-evasion component, in one instance terminating the endpoint vendor's own file-scanner process. The actor then used the management server to reach a backup server, domain controllers and application servers directly (Sophos X-Ops, 2026-08-04); an RMM platform's whole value is reach, and that reach transfers to whoever holds the console.

Hunt concepts, telemetry class first. In account-management telemetry, local and domain account creation events sourced from the N-central service-account context are the first artefact. In process-creation telemetry with parent lineage, account-enumeration and domain-trust utilities invoked by the N-central server process rather than by an interactive administrator session is a lineage anomaly no legitimate workflow produces. In software-inventory telemetry, the presence of any remote-monitoring agent an endpoint was never provisioned with is high-fidelity regardless of which product it is. In binary-integrity telemetry, a process whose filename claims a Microsoft update component but whose signature and hash do not match that publisher is the renamed tunnel client. In driver-load telemetry, a newly loaded kernel driver staged under a remote-access tool's data directory is the evasion component.

Triage: managed-service estates legitimately run remote-access tooling, and a second product can appear during a genuine tooling migration; the discriminators are whether the deployment correlates with a change record, whether it arrived through the console at a time no administrator was working, and whether the same push reached hosts outside the migration's scope. A signed remote-access binary is not itself suspicious; a signed remote-access binary that nobody in IT deployed is.

Update09 Aug 2026 05:08 UTCrun 2026-08-09T0412Z-intelactionscvesevidencesourcesbody

The remediation named in this pipeline's earlier coverage is no longer the endpoint. N-able published N-central 2026.3 Hotfix 2, build 2026.3.1.10, on 2026-08-06, and states that it is not a duplicate of the previous communication: Hotfix 2 is required even for partners who already applied the earlier hotfix, and it supersedes Hotfix 1 with additional hardening measures (N-able, 2026-08-06). The vendor frames it as proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques, rather than as a fix for a newly identified flaw (N-able, 2026-08-06). On-premises instances can upgrade directly to 2026.3.1.10 from 2025.4, 2026.1, 2026.2, 2026.3 or the 2026.3.1 Hotfix 1 build, and hosted N-central (NCOD) environments have already had the mitigations applied and require no customer action; the hotfix itself does not require agents to be upgraded to protect against CVE-2026-18577 (N-able, 2026-08-06).

The second half of the delta is the blast radius. The Hacker News reports on 2026-08-08 that in the attacks N-able observed, the flaw let attackers obtain administrative access remotely and then use N-central's own Take Control feature to connect to systems inside the managed environment, where they registered a new service for a Cloudflare Tunnel that kept them in even after access to the N-central server was revoked (The Hacker News, 2026-08-08). N-able detected the unusual activity in a customer environment on 2026-07-31 and has confirmed a limited number of customers were affected; it has published an expanded set of network indicators and a custom service template that checks Windows endpoints in N-central against known indicators, while cautioning that a clean result should not be read as a guarantee that an environment was not impacted and should sit alongside a review of logs and account activity (The Hacker News, 2026-08-08).

Triage: a Cloudflare Tunnel client running as a service is not inherently malicious; it is ordinary infrastructure in plenty of estates, and RMM platforms legitimately install services on managed endpoints all day. The discriminator here is provenance and timing: the service appears on endpoints during or after the window in which the N-central server was exploitable, it was created through the RMM's own remote-control session rather than through a change ticket or a deployment policy, and it keeps beaconing after the management platform's access has been cut. Any one of those alone is weak; the sequence is the signal.

Update12 Aug 2026 04:48 UTCrun 2026-08-12T0411Z-intelcvesentitiesevidencesectorssourcestagstechniquesbody

The N-able N-central authentication-bypass chain this pipeline has tracked through two hotfixes now has an assessed actor and a named payload. Microsoft Threat Intelligence reported that "the Storm-1175 group began deploying a new ransomware strain on August 2 called StormEncryptor", and that the group is likely exploiting CVE-2026-18577 in N-central to obtain access (The Record, 2026-08-10). The hedge is Microsoft's own and matters: "Microsoft has not formally confirmed the access vector, but noted that StormEncryptor deployments began the same day the flaw was disclosed" (The Record, 2026-08-10). The same-day correlation is the evidence; a confirmed vector is not yet on the record.

The Record describes the actor as financially motivated and linked to China, and its prior activity is why the attribution changes a defender's calculus rather than just labelling it (The Record, 2026-08-10). Microsoft's own April 2026 profile of the group (which does not itself make a China attribution) describes high-tempo Medusa ransomware operations against vulnerable web-facing assets, and records the group moving from initial access to data exfiltration and ransomware deployment often within a few days and in some cases within 24 hours (Microsoft Threat Intelligence, 2026-04-06). Its earlier Medusa victims were healthcare, professional services and finance organisations in Australia, Britain and the United States; StormEncryptor is the departure from that tooling (The Record, 2026-08-10). Note what those sectors and countries describe: the group's previous victim set, not confirmed victims of this campaign, for which no count has been disclosed.

Two facts sharpen the exposure picture for anyone whose managed service provider runs N-central. N-able states it detected the original flaw in a zero-day attack on 31 July, though it is unclear whether the actor behind that first intrusion was Storm-1175; the initial patch was bypassed, forcing an emergency hotfix on 2 August and a second on 6 August with the warning that the first was not enough. And the patch gap is wide: after the fixes were available, Huntress found more than half of reachable N-central cloud servers across its partner base still unpatched, with 28.6% of self-hosted instances exposed (The Record, 2026-08-10). Huntress went as far as suggesting that anyone running N-central in a higher-risk environment where exposure cannot meaningfully be reduced may need to consider turning the tool off, while cautioning that doing so costs central visibility, patching and remote access when they may be needed most.

The structural point is the one this constituency should carry: a single compromised RMM server is a gateway to every endpoint it manages, so one breach at one provider cascades across its whole client base. The Record draws the direct comparison to the 2021 Kaseya intrusion, where REvil compromised around 60 direct customers and subsequently hit roughly 1,500 downstream businesses, and to the 2024 ScreenConnect attacks; in which Microsoft says Storm-1175 was among the actors targeting the product (The Record, 2026-08-10).

vulnerability03 Aug 05:05Zmulti-sourceOpen finding →

Sources: N-able · N-able status page · Huntress · Sophos X-Ops (Counter Threat Unit) · CISA · The Hacker News · The Record (Recorded Future News) · Microsoft Threat Intelligence

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

N-able N-central×2
productproduct:n-able-n-central
StormEncryptor×2
malwaremalware:stormencryptorlinked
Medusa×1
malwaremalware:medusa
N-able N-central, authentication bypass by primary weakness reaching internal APIs×1
cveCVE-2026-86207
N-able N-central, authentication bypass using an alternate path or channel (CWE-288), affects through 2026.1, fixed in 2026.2 (CVSS 8.2) | CISA KEV 2026-08-04.×1
cveCVE-2026-18556
N-able N-central, incomplete patch for CVE-2026-18556; unauthenticated admin auth bypass exploited in the wild, superseded by Hotfix 2 build 2026.3.1.10 of 2026-08-06, which the vendor requires even where 2026.3.1.7 was applied (CVSS 8.2)×1
cveCVE-2026-18577
N-able N-central, internal API access-control gap (part of the September 2026 auth-bypass chain)×1
cveCVE-2026-86206
N-able N-central, pre-authentication RCE zero-day, confirmed exploited in the wild×1
cveCVE-2026-86218

Where this entity is cited

Vulns1
Deep dive1
Research1

Source distribution

status.n-able.com4 (25%)
radar.offseq.com3 (19%)
cisa.gov1 (6%)
huntress.com1 (6%)
microsoft.com1 (6%)
n-able.com1 (6%)
recordedfuture.com1 (6%)
securelist.com1 (6%)
other3 (19%)

All cited sources (16)