Cybersecurity

N-central's Second Hotfix Came After the Ransomware Did

Microsoft attributes a new ransomware strain, StormEncryptor, to a China-linked group that broke into customer networks through the same N-able N-central flaw a first patch failed to close. N-able shipped a second hotfix on August 10, four days after confirming attackers had already reached managed endpoints.

CybersecurityBy Servola Tech Desk2026-08-144 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

N-central's Second Hotfix Came After the Ransomware Did

Key takeaways

Microsoft Threat Intelligence has attributed a previously undocumented ransomware strain, which it calls StormEncryptor, to Storm-1175, a China-linked, financially motivated group that Microsoft says likely gained initial access through CVE-2026-18577, an authentication bypass in N-able's N-central remote monitoring and management platform. This is the first activity Microsoft has observed from the group since April 2026, and a shift away from its previous tool, Medusa ransomware, published August 10, 2026. If your organization is only tracking whether N-central is patched, that question no longer covers the actual risk, because a live ransomware strain already exists for the gap the patch was meant to close.
N-able's own security update confirms attackers reached customer networks with a 'limited' number of confirmed victims, took over administrator accounts on affected N-central servers, and used the platform's own Take Control feature to reach the endpoints it manages, before N-able shipped a second hotfix, version 2026.3.1.10, on August 10, 2026, described as required even for customers who had already applied the first one issued on August 2. A patch that needed a second version eight days later is not a closed vulnerability; it is a moving target, and any MSP client relying on a single 'yes, we patched it' answer from early August is working from stale information.
StormEncryptor itself is a new detail, not a restatement of the original flaw: it is written in C++, appends '.encrypted' to files it locks, and drops a ransom note named '!!!README_FIRST!!!.txt' in every directory it scans, per Microsoft's writeup. Storm-1175 moves from initial access to data exfiltration and ransomware deployment within days, using AnyDesk and SimpleHelp for remote access, Advanced IP Scanner for network discovery, and Mimikatz for LSASS credential dumping, a toolkit distinct enough from routine intrusion activity that an MSP's monitoring team should be able to name it, not just confirm a patch level.
The single-console structure of N-central is what turns one authentication bypass into a multi-tenant incident: an MSP's console manages every downstream client's endpoints through the same Take Control feature Storm-1175 abused, so one compromised console is a master key to however many client networks that MSP runs. N-able has not disclosed how many downstream endpoints were reached or which sectors were affected, which means any organization relying on an MSP that uses N-central is currently unable to confirm from public information alone whether it was one of the 'limited number' of victims.
The distance between the two public accounts of this incident is the story: on August 3, CISA listed CVE-2026-18577 as a known exploited vulnerability based on a bypass of an earlier patch, framed as a vulnerability-management problem. By August 10, Microsoft was naming a nation-state-linked actor's new ransomware family moving through that same hole in days, framed as an active-intrusion problem. Organizations that treated the August 3 KEV listing as the headline and stopped watching missed the escalation that mattered.

A Patch That Needed a Sequel

N-able's timeline reads like a vulnerability that would not stay fixed. CVE-2026-18556, an authentication bypass in N-central, was patched first. Attackers then found, in N-able's own words, 'a variation that evades the previous patch's specific checks,' tracked as CVE-2026-18577, exploited from around August 1 and added to CISA's Known Exploited Vulnerabilities catalog on August 3. N-able shipped Hotfix 1, version 2026.3.1.7, on August 2. That should have been the end of the story.

It was not. On August 10, N-able shipped Hotfix 2, version 2026.3.1.10, explicitly required even for customers who had already applied Hotfix 1. The vendor's own security update from that date confirms attackers had, by then, reached a limited number of customer networks, taken over administrator accounts, and used the platform's Take Control feature to touch managed endpoints. A second mandatory hotfix eight days after the first is the clearest possible signal that the first patch did not fully close the door.

The Ransomware That Answers the Question the Patch Timeline Raised

The open question after Hotfix 1 was whether the bypass had actually been used for anything beyond reconnaissance. Microsoft's August 10 attribution answers it: Storm-1175, a China-linked, financially motivated group Microsoft has tracked since at least its earlier Medusa ransomware campaigns, deployed a previously undocumented strain, StormEncryptor, likely gaining initial access through CVE-2026-18577. It is the group's first observed activity since April 2026, and its first documented move away from Medusa.

StormEncryptor is written in C++, appends '.encrypted' to locked files, and leaves a ransom note titled '!!!README_FIRST!!!.txt' in every scanned directory. Microsoft describes the group moving from initial compromise to data exfiltration and ransomware deployment within days, using AnyDesk and SimpleHelp for remote access, Advanced IP Scanner for discovery, and Mimikatz for LSASS credential dumping. That is a concrete, nameable toolkit an MSP's incident response team can hunt for directly, rather than a generic warning to 'check your patch level.'

Why One Compromised Console Is Everyone's Problem

N-central exists specifically so one MSP technician can manage many client networks from a single console, using the Take Control feature to reach any managed endpoint without visiting it. That design is the product's entire value proposition, and it is also exactly what Storm-1175 abused: an administrator takeover of one N-central console hands an attacker the same reach across every client network that console legitimately manages. N-able has described the number of confirmed victims as 'limited' but has not published a count, named affected MSPs, or specified which downstream sectors were touched.

That silence puts the burden on every organization that outsources IT to an MSP running N-central to ask directly, rather than assume: has our MSP's N-central instance been confirmed clean, not just patched twice, and has it been checked for the specific indicators Microsoft published, Cloudflare Tunnel services, AnyDesk or SimpleHelp installs the MSP did not authorize, and any LSASS access consistent with Mimikatz use.

Two Public Framings of the Same Hole, Eight Days Apart

On August 3, 2026, the public framing of CVE-2026-18577 was a vulnerability-management story: a patch bypass, added to a compliance catalog, with a federal remediation deadline. That framing invites a checkbox response, patch it and move on. By August 10, the framing had changed to an active-intrusion story: a named, previously undocumented ransomware family, attributed to a group Microsoft links to China, already moving through networks in days.

The seven days between those two framings is the real lesson for any organization that treats a KEV listing as the end of a vulnerability's story rather than the start of an incident-response one. A CVE number tells you what to patch. It does not tell you whether someone already got in before you did, and in this case, N-able's own timeline confirms that some customers found out the second way.

Frequently asked questions

What is StormEncryptor and who is behind it?

StormEncryptor is a previously undocumented ransomware strain, written in C++, that Microsoft Threat Intelligence attributes to Storm-1175, a China-linked, financially motivated group. It is the first activity Microsoft has observed from the group since April 2026 and marks a shift away from its earlier tool, Medusa ransomware. Microsoft says the group likely gained initial access through CVE-2026-18577, an authentication bypass in N-able's N-central platform.

Why did N-able need a second hotfix for the same vulnerability?

N-able's Hotfix 1, shipped August 2, 2026, patched CVE-2026-18556 but left a bypass, tracked as CVE-2026-18577, that attackers exploited from around August 1. N-able's Hotfix 2, shipped August 10, 2026, was described as required even for customers who had already applied Hotfix 1, and N-able's own security update confirmed attackers had reached a limited number of customer networks and taken over administrator accounts in the interim.

Why does a flaw in one MSP tool put multiple organizations at risk?

N-central is designed to let a single console manage the endpoints of many downstream client networks through its Take Control feature. An attacker who takes over an N-central console inherits that same reach, meaning one compromised MSP console can expose every client network that console legitimately manages, not just the MSP's own systems.

What should organizations that use an N-central-based MSP do now?

Confirm directly with your MSP that both hotfixes, 2026.3.1.7 and 2026.3.1.10, are applied, not just the first one, and ask whether the MSP has checked for indicators Microsoft has published: unauthorized Cloudflare Tunnel services, AnyDesk or SimpleHelp installations the MSP did not deploy, Advanced IP Scanner activity, and LSASS access consistent with Mimikatz credential dumping. A patch confirmation alone does not rule out prior compromise.

A CVE number and a KEV listing describe a vulnerability. They do not describe what already happened through it, and the eight days between N-able's first and second hotfix is exactly the window in which that gap mattered: a China-linked group built a new ransomware strain, moved from access to encryption in days, and N-able confirmed real customer networks were reached before the second patch even shipped. Any organization that outsources IT to an MSP running N-central and has only asked whether the software is patched has asked the wrong question. The right one is whether anyone already got in while the patching was still happening, and that answer does not come from a version number.

N-ableN-centralStorm-1175StormEncryptorMSP SecurityRansomware

Patching SharePoint No Longer Closes the Door

CISA added a critical SharePoint Server flaw to its exploited-vulnerabilities list on 17 July 2026 with a 19 July patch deadline. Attackers are stealing server keys, so patching alone leaves the door open. What on-premises owners must do.

4 min read

Cybersecurity

One Supplier Breach Drove Half of Europe's Ransomware Victims

Black Kite's 2026 report shows one supplier breach drove over half of Europe's third-party ransomware victims. Under NIS2 and DORA, the liability is yours.

2 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.