Storm-1175 Exploits Critical N-central Flaw to Target MSPs

Ransomware Attacks Through N-able N-central

Microsoft Threat Intelligence has attributed a ransomware campaign targeting N-able N-central deployments to Storm-1175, a financially motivated group linked to China.

The group began deploying StormEncryptor on August 2, just days after the discovery of a zero-day attack against the platform. Microsoft has not confirmed, however, that exploitation of N-central was definitively the initial access vector.

The vulnerability, tracked as CVE-2026-18577, was first observed in an attack on July 31. It is not known whether that operation was already being conducted by Storm-1175.

One Compromise Can Spread to All of an MSP’s Customers

N-central is an RMM console used by managed service providers to centrally administer endpoints belonging to multiple organizations.

CVE-2026-18577 is classified as critical. It allows attackers to obtain full administrative privileges on an N-central server without authentication or credentials. An attacker who compromises a console can therefore reach hosts managed by the MSP and attempt to deploy ransomware across the entire downstream infrastructure.

Huntress has confirmed impact on some of its customers and documented rapid propagation to managed hosts in two incidents. The total number of affected organizations remains unknown.

The scenario mirrors previous attacks against RMM platforms. In 2021, REvil spread from 60 direct Kaseya customers to approximately 1,500 downstream companies. In 2024, a vulnerability in ConnectWise ScreenConnect fueled numerous ransomware attacks, including some attributed to Storm-1175.

The Initial Fixes Were Not Enough

N-able released an initial hotfix on August 2, but attackers managed to bypass it. The vendor subsequently released a second hotfix on August 6, warning that the first update was insufficient.

The exact affected N-central versions have not been disclosed. Organizations should apply both hotfixes and verify cloud and self-hosted deployments separately.

After the fixes became available, Huntress still found more than half of cloud-based N-central servers accessible without the required updates. Among self-hosted instances, 28.6% remained exposed.

What MSPs and Their Customers Should Do

Administrators should:

• apply both N-able hotfixes, including the one released on August 6;
• immediately identify which N-central servers remain accessible from the Internet;
• reduce exposure for non-essential systems;
• inspect downstream endpoints for signs of encryption, lateral movement, and anomalous activity;
• consider temporarily shutting down N-central in high-risk environments that are not adequately protected.

Disabling N-central will, however, interrupt centralized visibility, patch management, and remote access. Before taking this step, the MSP should assess the potential impact on incident response and customer operations.

Microsoft reports that Storm-1175 has already targeted healthcare, financial, and professional services organizations in Australia, the United Kingdom, and the United States. In previous campaigns, the group progressed from initial access to full encryption in less than 24 hours.