Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
Storm-1175 Deploys New StormEncryptor Ransomware, Likely Exploiting N-able Flaw
Malware Families
Excerpt
Microsoft Threat Intelligence has observed the financially motivated threat actor Storm-1175 deploying a previously unseen ransomware family, dubbed StormEncryptor, beginning August 2, 2026. The activity represents the group’s first publicly observed campaign since April and signals a departure from Medusa ransomware, which Storm-1175 had previously used in extortion operations. The campaign may be tied to the rapid weaponization of CVE-2026-18577 , an authentication-bypass…
Read the original report →Diamond Model
Adversary
Infrastructure
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-18577 | High | Score 69/100 | First seen |
| SHA256 | c19ded65e822bb43ad0381c58abf33b7c8890f7bcc7125058a0c849c7e1a6054 | Low | Score 32/100 | First seen |
IOC Relationship Graph
Building graph…