AI-generated · no human review · verify critical claims against the linked source.how it works →
Medusa
malware
· malware:medusasingle-source
Ransomware-as-a-service operation that emerged in 2021 as a closed group and moved to an affiliate model in 2023, tracked by CISA, the FBI and HHS in the joint #StopRansomware advisory AA25-071A. The 2026-08-18 update, carrying FBI investigative data through April 2026, raised the recorded victim count from more than 300 to more than 500; the only sector list the cited reporting carries covers medical, education, legal, insurance and manufacturing. The agencies state affiliates exploit newly announced vulnerabilities within 24 hours and have been observed using exploits up to a week before public disclosure while developing no zero-day or N-day flaws of their own, obtaining that exploit access from sources the agencies could not identify. Separately from exploit access, initial-access brokers who sell entry into victim networks are paid between $100 and $1 million with a premium for exclusivity; post-compromise the affiliates use legitimate remote-management software and RDP rather than bespoke tooling. The group had added no new leak-site victims since April at the time of the update (CyberScoop and The Record, both 2026-08-18). Distinct from the unrelated MedusaLocker and MedusaHVNC families already tracked in this registry.
23 techniques observed across 3 entries, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)
Initial Access TA0001
T1078Valid Accounts×1
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.
T1059.001Command and Scripting Interpreter: PowerShell×1
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
T1059.003Command and Scripting Interpreter: Windows Command Shell×1
Adversaries may abuse the Windows command shell for execution. The Windows command shell (cmd) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. The command prompt can be invoked remotely via Remote Services such as SSH.
T1059.004Command and Scripting Interpreter: Unix Shell×1
Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.
Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Adversaries may create a domain account to maintain access to victim systems. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover user, administrator, and service accounts. With a sufficient level of access, the <code>net user /add /domain</code> command can be used to create a domain account.
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.
T1543.003Create or Modify System Process: Windows Service×1
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1543.003Create or Modify System Process: Windows Service×1
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
T1036.005Masquerading: Match Legitimate Resource Name or Location×1
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as cloud monitoring agents and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Adversaries may gain access to and use centralized software suites installed within an enterprise to execute commands and move laterally through the network. Configuration management and software deployment applications may be used in an enterprise network or cloud environment for routine administration purposes. These systems may also be integrated into CI/CD pipelines. Examples of such solutions include: SCCM, HBSS, Altiris, AWS Systems Manager, Microsoft Intune, Azure Arc, and GCP Deployment Manager.
Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.
T1071.001Application Layer Protocol: Web Protocols×1
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp. Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer).
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.
Adversaries may steal data by exfiltrating it over an existing command and control channel. Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
researchInsikt Group: the same six-tool stack followed thirteen unrelated CVEs into Exchange, SharePoint, FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer and Apache Shiro
active-threatsA ransomware crew that develops no zero-days still beats the patch window, on exploits it obtains from sources the agencies cannot identify
Recorded Future's Insikt Group published its H1 2026 Malware and Vulnerability Trends report on 3 September 2026, tracking 215 actively exploited CVEs in the first half of 2026, up 34% from 161 in H1 2025 (Recorded Future, 2026-09-03). Of those, 176 (82%) were network-accessible and 146 (68%) could be exploited without prior authentication; 142 of those 146 combined both properties, and 60 of 82 remote-code-execution CVEs combined network reachability, no authentication requirement and code execution in a single package (Recorded Future, 2026-09-03).
The report's most actionable finding for defenders is that post-exploitation tool-stack reuse persists across otherwise-unrelated initial-access vulnerabilities, regardless of vendor or product family (Recorded Future, 2026-09-03). A cluster the report designates StrikeShark applied an identical six-tool post-exploitation stack (SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer and SharpGPOAbuse) across thirteen separate CVEs spanning 2016 through 2025, reaching Microsoft Exchange, Microsoft SharePoint, Fortinet FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer and Apache Shiro (Recorded Future, 2026-09-03); SharkLoader itself was previously profiled by Kaspersky's GReAT, which found it deploying Cobalt Strike via "Perfect DLL Hijacking" in a campaign whose confirmed victims spanned government and diplomatic entities, software developers and organizations in several other sectors and regions (Kaspersky Securelist, 2026-06-24). Separately, Storm-1175 linked Mimikatz, Impacket, PsExec, Rclone and Medusa ransomware across ten different initial CVEs; a China-linked cluster the report designates SHADOW-EARTH-053 separately reused Mimikatz following exploitation of CVE-2021-26855 in Microsoft Exchange Server (Recorded Future, 2026-09-03). Insikt Group mapped 114 of the 215 CVEs to MITRE ATT&CK: exploitation of a public-facing application was associated with 77 CVEs (68%), and 50 of those 77 also co-occurred with PowerShell, Windows Command Shell or Unix Shell execution; every one of the 28 web-shell-associated CVEs also carried the public-facing-application technique. The next most frequently associated post-exploitation behaviors across the mapped CVEs were system-information discovery, collection of data from the local system, transfer of further tooling into the compromised environment, and exfiltration over the command-and-control channel or web-protocol-based C2 traffic (Recorded Future, 2026-09-03).
The report's own defender-facing conclusion is explicit: because the same limited tool stack recurs regardless of which vulnerability supplied the initial foothold, detection engineering should chain exploitation telemetry from public-facing systems through to the post-exploitation behaviors these clusters repeat (credential dumping, remote-service execution via native administration mechanisms, bulk outbound data transfer, and ransomware staging) rather than treating each CVE alert as an isolated, one-off event (Recorded Future, 2026-09-03).
Threat actors reused post-exploitation playbooks across different initial vulnerabilities; StrikeShark applied the same six-tool stack across thirteen CVEs, while Storm-1175 linked credential theft, remote execution, data transfer, and ransomware tooling across ten.
In the StrikeShark campaign, SharkLoader, Cobalt Strike Beacon, FScan, Searchall, Pillager Stealer, and SharpGPOAbuse were linked to the same thirteen CVEs. Those vulnerabilities spanned 2016 through 2025 and affected Microsoft Exchange and SharePoint, Fortinet FortiOS, Cisco IOS XE, F5 BIG-IP, GeoServer, Apache Shiro, and other public-facing technologies.
50 of the 77 CVEs associated with the exploitation of public-facing applications were also linked to PowerShell, Windows Command Shell, or Unix Shell, and all 28 web-shell-associated CVEs also included T1190.
CISA, the FBI and the Department of Health and Human Services published an update to the joint #StopRansomware advisory on Medusa on 2026-08-18, folding in FBI investigative findings through April 2026. The headline number is cumulative rather than current: CyberScoop records that "the victim tally in the advisory jumped from more than 300 to more than 500" (CyberScoop, 2026-08-18) since the original March 2025 advisory, roughly two hundred additional organisations identified over the intervening year. On sectors, the only list any of the cited outlets publishes is healthsystemCIO's, which records the figure as spanning every sector the agencies track, including medical, education, legal, insurance and manufacturing. HHS joined as a co-sealer specifically to add the healthcare perspective, describing the Healthcare and Public Health Sector as a frequent victim of Medusa activity (healthsystemCIO, 2026-08-18).
The finding worth carrying into planning is about speed, and it is unusual in being paired with an explicit negative. The agencies state the group exploits "newly announced exploits within 24 hours" and has "been observed to use exploits up to a week before public vulnerability disclosure", and then rule out the obvious inference: "However, there is no indication Medusa actors develop their own zero-day or N-day vulnerabilities, preferring instead to obtain advanced access to exploits from unknown sources or to quickly leverage newly announced exploits before potential victims can mitigate vulnerabilities through patching" (The Record, 2026-08-18). That combination is the planning fact. An organisation cannot out-wait this actor by assuming a research lead time the group has to fund itself: the pre-disclosure window comes from exploit access obtained somewhere the agencies could not identify, and the 24-hour window comes from acting on the same public advisory the defender is reading. A patch cycle measured in weeks is not a control against it, and the compensating control is exposure reduction on internet-facing software rather than faster patching alone.
The economics of entry are spelled out separately, and are not the same market as the exploit access above, these payments buy a way into a victim network, not a vulnerability. The gang relies on access brokers, "compensating them anywhere from $100 to $1 million, with higher prices going to those who work exclusively with Medusa", while most brokers work simultaneously for multiple ransomware variants (CyberScoop, 2026-08-18); The Record records the same exclusivity premium, noting Medusa "recruits members on cybercriminal forums and offers up to $1 million to initial access brokers who want to work exclusively for the group" (The Record, 2026-08-18). The practical consequence of brokers serving several operations at once is that an access sold into this ecosystem is not tied to one outcome; the same foothold may surface under a different brand.
Post-compromise, the advisory names the tooling rather than bespoke malware. Affiliates deploy credential-stealing tools first, then move to legitimate remote-management software to evade detection: "The FBI said Medusa actors used remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop" (The Record, 2026-08-18), with Remote Desktop Protocol for lateral movement (CyberScoop, 2026-08-18). Two products from the group's historically exploited list are named, each by a different outlet: CyberScoop records the advisory covering flaws in Fortra's GoAnywhere and BeyondTrust (CyberScoop, 2026-08-18), while healthsystemCIO is the outlet that identifies the February 2026 BeyondTrust disclosure as the advisory's own worked example of how quickly a public disclosure becomes an intrusion (healthsystemCIO, 2026-08-18).
One honest caveat belongs next to the victim count: The Record reports that "Medusa has not added any new victims to its leak site since April", with several experts attributing the pause to law-enforcement attention drawn by an attack on a US medical centre (The Record, 2026-08-18). The 500-plus figure is therefore a record of what happened through April, not evidence of a wave in progress; the advisory's value here is the tradecraft and the tempo, not a current-activity signal.
been observed to use exploits up to a week before public vulnerability disclosure
However, there is no indication Medusa actors develop their own zero-day or N-day vulnerabilities, preferring instead to obtain advanced access to exploits from unknown sources or to quickly leverage newly announced exploits before potential victims can mitigate vulnerabilities through patching
The FBI said Medusa actors used remote access software AnyDesk, Atera, ConnectWise, eHorus, N-able, BeyondTrust, SimpleHelp and Splashtop.
N-able disclosed and then re-patched a critical authentication bypass in N-central, the remote monitoring and management platform managed service providers use to monitor, patch and remotely access customer estates. The vendor's own account of the attack is that "an attacker had identified a vulnerability on all N‑central servers running a version prior to 2026.3.1.7, which allowed them to obtain administrative access remotely" (N-able, 2026-08-02). The sequence matters as much as the flaw. N-able first addressed the issue in 2026.2 and, on 1 August, told customers still on older builds to move to 2026.3 as an immediate protective measure (N-able, 2026-08-02); its initial advisory tied the exploitation to CVE-2026-18556, while the hotfix that followed pointed at CVE-2026-18577 (Huntress, 2026-08-03). What changed in between is that the vendor "identified an alternative method to exploit this vulnerability, which was not mitigated in our previous fix" (N-able, 2026-08-02). Huntress records the second identifier's published description as "an incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1" (Huntress, 2026-08-03). Hotfix build 2026.3.1.7 shipped the same afternoon (N-able status page, 2026-08-02). One discrepancy in the vendor's own material is worth resolving before you scope your estate: the status notice describes the issue as affecting every N-central instance not running 2026.3.1, while the security blog says the attacker reached all servers "running a version prior to 2026.3.1.7" and the published CVE description gives the affected range as through 2026.3.1. The blog and the CVE record agree with each other, so 2026.3.1 is affected and 2026.3.1.7 is the fixed build, for anyone sitting on 2026.3.1 the single digit is the whole decision.
N-able dates the start of the visible signal precisely: "On July 31, 2026, N‑able saw an increase in licensing issues for our on-premises N‑central customers", the anomaly that put its engineering and security teams on the investigation (N-able, 2026-08-02), which is why 31 July is the sensible left edge for scoping a look-back. Exploitation is confirmed but so far bounded: N-able says "A limited number of customers have been identified to be impacted" (N-able, 2026-08-02), and Huntress reports it "has seen exploitation impacting one organization in our customer base" as of publication (Huntress, 2026-08-03). What removes the comfort from those numbers is the blast radius of the product: Huntress states that "a compromised N-central server can be used to run scripts, push tools, and open remote sessions across every downstream endpoint it manages", including domain controllers, and that an attacker in the console can also create administrative accounts and loosen security-relevant policy (Huntress, 2026-08-03). The observed post-exploitation path is the platform's own tooling rather than malware: N-able records that "the attacker leveraged the Take Control feature and connected to systems within the N‑central managed environment" and that on those devices "the attackers registered a new service for a CloudFlare tunnel, enabling persistence into an environment after access to the N‑central server was revoked" (N-able, 2026-08-02).
Two facts from an update Huntress added on 3 August shape how any of this can actually be hunted. First, the platform's exposure is worse than the confirmed-victim count suggests: at the time of that update "more than half (55.6%) of our partners' and customers' reachable cloud servers were still unpatched" (Huntress, 2026-08-03). Second, the compromised asset is itself a telemetry gap; Huntress notes that "the N-able server runs a custom distribution of AlmaLinux 9, and does not often have EDR software deployed on it due to running as an appliance" (Huntress, 2026-08-03), so the endpoint agent that would normally carry this investigation is frequently absent from the one host that matters most. Detection therefore leans on the server's own application logs and on what the pivot leaves behind downstream. In web-application and authentication logs on the N-central server itself, the signal is administrative activity and remote-control sessions with no corresponding legitimate credential use, Huntress points defenders at the console's UI and remote-access logs and flags sessions whose viewer account presents as a vendor support identity, or that target domain controllers and file servers, or that fall outside the team's working pattern. On managed Windows endpoints, Take Control leaves log files under C:\ProgramData\GetSupportService_N-Central\Logs\, and in service-installation telemetry the durable artifact is an unexpected service registered under the name Cloudflared, and in file-system terms a binary named svchost.exe sitting in a user's Documents folder, both named by N-able as the things to look for on a device you suspect (N-able status page, 2026-08-02). The second is worth dwelling on: the real Windows service host only ever runs from the system directories, so that filename anywhere under a user profile is anomalous by construction. In egress telemetry the signal is outbound tunnel traffic from hosts that have no business originating it. Because the console bypass needs no credentials, Huntress advises that an N-central server still broadly reachable from the internet or other untrusted networks should be considered for temporary shutdown until the hotfix is applied and it can be returned behind strict network controls (Huntress, 2026-08-03).
Triage: the vendor's published network indicators are not a safe discriminator on their own. Huntress found that "the four IPs N-able initially flagged as malicious are actually Mullvad or NordVPN VPN exit nodes" (Huntress, 2026-08-03), shared commercial infrastructure that ordinary users and unrelated traffic also originate from, so a match is a prompt to investigate the session, never a finding in itself. Take Control log files under GetSupportService_N-Central\Logs\ are not themselves evidence of compromise; Huntress is explicit that "these logs are also created during legitimate Take Control usage" (Huntress, 2026-08-03), so they are a pivot rather than a detection. The discriminators are the surrounding facts: whether the session maps to a ticket or technician, whether the viewer identity is one of your own staff, the criticality of the target host, and the time of day. A service registered as Cloudflared, or an svchost.exe under a user's Documents folder, is the sharper signal; a remote-support session that legitimately used Take Control has no reason to leave either behind (N-able status page, 2026-08-02).
an attacker had identified a vulnerability on all N‑central servers running a version prior to 2026.3.1.7
we identified an alternative method to exploit this vulnerability, which was not mitigated in our previous fix
the attackers registered a new service for a CloudFlare tunnel, enabling persistence into an environment after access to the N‑central server was revoked
Exploitation is active in the wild; a compromised N-central server can be used to run scripts, push tools, and open remote sessions across every downstream endpoint it manages.
N-able's initial security advisory linked this critical vulnerability to CVE-2026-18556; while the subsequent hotfix pointed to CVE-2026-18577.
the threat actor used the compromised N-central server to access high-value endpoints such as a backup server, domain controllers, and application servers
the PhantomKiller endpoint detection and response (EDR) evasion tool loaded a driver named k.sys, which was located in C:\\ProgramData\\AnyDesk
This is not a duplicate of our previous communication; Hotfix 2 is required, even if you already applied the earlier hotfix. Hotfix 2 supersedes Hotfix 1 with additional hardening measures to further protect you and your customers.
Upon gaining access to those devices, the threat actors registered a new service for a Cloudflare Tunnel, enabling persistence even after access to the N‑central server was revoked.
Two developments turn the N-able N-central authentication bypass from a patching task into a compromise-assessment task. CISA added CVE-2026-18556 to its Known Exploited Vulnerabilities catalog on 2026-08-04, based on evidence of active exploitation (CISA, 2026-08-04). More usefully, Sophos X-Ops has published what the actor did after taking the console (Sophos X-Ops, 2026-08-04), the original coverage described the flaw and the incomplete first fix, but not the post-exploitation chain, and that chain is what determines whether the hotfix was sufficient.
On the management server itself, the actor created a new domain account under a backup-product name, reset existing administrator credentials, and enumerated accounts, domain-administrator group membership and installed security products before moving on (Sophos X-Ops, 2026-08-04). The reconnaissance is unremarkable; the account creation and credential reset are not, because they survive the platform being patched.
The console was then used as a distribution channel. Sophos records six different remote-monitoring-and-management tools pushed from the compromised N-central console onto reachable endpoints (AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp and HopToDesk) establishing remote access that no longer depends on N-central at all (Sophos X-Ops, 2026-08-04). That is the structural point for anyone who patched and moved on: the entry point was closed, and six independent ways back in were already in place. Alongside them a Cloudflare Tunnel client was deployed and renamed to a Microsoft-update-styled filename, giving persistent outbound tunnelling that blends into ordinary update traffic by name, and a kernel driver Sophos names PhantomKiller was loaded from a remote-support tool's ProgramData directory as an endpoint-detection-evasion component, in one instance terminating the endpoint vendor's own file-scanner process. The actor then used the management server to reach a backup server, domain controllers and application servers directly (Sophos X-Ops, 2026-08-04); an RMM platform's whole value is reach, and that reach transfers to whoever holds the console.
Hunt concepts, telemetry class first. In account-management telemetry, local and domain account creation events sourced from the N-central service-account context are the first artefact. In process-creation telemetry with parent lineage, account-enumeration and domain-trust utilities invoked by the N-central server process rather than by an interactive administrator session is a lineage anomaly no legitimate workflow produces. In software-inventory telemetry, the presence of any remote-monitoring agent an endpoint was never provisioned with is high-fidelity regardless of which product it is. In binary-integrity telemetry, a process whose filename claims a Microsoft update component but whose signature and hash do not match that publisher is the renamed tunnel client. In driver-load telemetry, a newly loaded kernel driver staged under a remote-access tool's data directory is the evasion component.
Triage: managed-service estates legitimately run remote-access tooling, and a second product can appear during a genuine tooling migration; the discriminators are whether the deployment correlates with a change record, whether it arrived through the console at a time no administrator was working, and whether the same push reached hosts outside the migration's scope. A signed remote-access binary is not itself suspicious; a signed remote-access binary that nobody in IT deployed is.
The remediation named in this pipeline's earlier coverage is no longer the endpoint. N-able published N-central 2026.3 Hotfix 2, build 2026.3.1.10, on 2026-08-06, and states that it is not a duplicate of the previous communication: Hotfix 2 is required even for partners who already applied the earlier hotfix, and it supersedes Hotfix 1 with additional hardening measures (N-able, 2026-08-06). The vendor frames it as proactively expanding protections in response to ongoing monitoring of threat actors as they evolve their attack techniques, rather than as a fix for a newly identified flaw (N-able, 2026-08-06). On-premises instances can upgrade directly to 2026.3.1.10 from 2025.4, 2026.1, 2026.2, 2026.3 or the 2026.3.1 Hotfix 1 build, and hosted N-central (NCOD) environments have already had the mitigations applied and require no customer action; the hotfix itself does not require agents to be upgraded to protect against CVE-2026-18577 (N-able, 2026-08-06).
The second half of the delta is the blast radius. The Hacker News reports on 2026-08-08 that in the attacks N-able observed, the flaw let attackers obtain administrative access remotely and then use N-central's own Take Control feature to connect to systems inside the managed environment, where they registered a new service for a Cloudflare Tunnel that kept them in even after access to the N-central server was revoked (The Hacker News, 2026-08-08). N-able detected the unusual activity in a customer environment on 2026-07-31 and has confirmed a limited number of customers were affected; it has published an expanded set of network indicators and a custom service template that checks Windows endpoints in N-central against known indicators, while cautioning that a clean result should not be read as a guarantee that an environment was not impacted and should sit alongside a review of logs and account activity (The Hacker News, 2026-08-08).
Triage: a Cloudflare Tunnel client running as a service is not inherently malicious; it is ordinary infrastructure in plenty of estates, and RMM platforms legitimately install services on managed endpoints all day. The discriminator here is provenance and timing: the service appears on endpoints during or after the window in which the N-central server was exploitable, it was created through the RMM's own remote-control session rather than through a change ticket or a deployment policy, and it keeps beaconing after the management platform's access has been cut. Any one of those alone is weak; the sequence is the signal.
The N-able N-central authentication-bypass chain this pipeline has tracked through two hotfixes now has an assessed actor and a named payload. Microsoft Threat Intelligence reported that "the Storm-1175 group began deploying a new ransomware strain on August 2 called StormEncryptor", and that the group is likely exploiting CVE-2026-18577 in N-central to obtain access (The Record, 2026-08-10). The hedge is Microsoft's own and matters: "Microsoft has not formally confirmed the access vector, but noted that StormEncryptor deployments began the same day the flaw was disclosed" (The Record, 2026-08-10). The same-day correlation is the evidence; a confirmed vector is not yet on the record.
The Record describes the actor as financially motivated and linked to China, and its prior activity is why the attribution changes a defender's calculus rather than just labelling it (The Record, 2026-08-10). Microsoft's own April 2026 profile of the group (which does not itself make a China attribution) describes high-tempo Medusa ransomware operations against vulnerable web-facing assets, and records the group moving from initial access to data exfiltration and ransomware deployment often within a few days and in some cases within 24 hours (Microsoft Threat Intelligence, 2026-04-06). Its earlier Medusa victims were healthcare, professional services and finance organisations in Australia, Britain and the United States; StormEncryptor is the departure from that tooling (The Record, 2026-08-10). Note what those sectors and countries describe: the group's previous victim set, not confirmed victims of this campaign, for which no count has been disclosed.
Two facts sharpen the exposure picture for anyone whose managed service provider runs N-central. N-able states it detected the original flaw in a zero-day attack on 31 July, though it is unclear whether the actor behind that first intrusion was Storm-1175; the initial patch was bypassed, forcing an emergency hotfix on 2 August and a second on 6 August with the warning that the first was not enough. And the patch gap is wide: after the fixes were available, Huntress found more than half of reachable N-central cloud servers across its partner base still unpatched, with 28.6% of self-hosted instances exposed (The Record, 2026-08-10). Huntress went as far as suggesting that anyone running N-central in a higher-risk environment where exposure cannot meaningfully be reduced may need to consider turning the tool off, while cautioning that doing so costs central visibility, patching and remote access when they may be needed most.
The structural point is the one this constituency should carry: a single compromised RMM server is a gateway to every endpoint it manages, so one breach at one provider cascades across its whole client base. The Record draws the direct comparison to the 2021 Kaseya intrusion, where REvil compromised around 60 direct customers and subsequently hit roughly 1,500 downstream businesses, and to the 2024 ScreenConnect attacks; in which Microsoft says Storm-1175 was among the actors targeting the product (The Record, 2026-08-10).