One RMM Server, Every Customer: Inside the N-central Patch Bypass Storm-1175 Rode Into MSP Networks

On July 31, 2026, N-able's own managed detection team flagged unusual activity inside a customer environment. Within twenty-four hours the company had an advisory out. Within ten days it had shipped two hotfixes, the second one because the first did not fully close the hole. Somewhere in that window, a financially motivated crew that Microsoft tracks as Storm-1175 walked into N-central servers with administrative rights and started reaching down into the endpoints those servers manage.

I have spent a lot of time on the offensive side looking at management platforms, and this one deserves a careful read. Not because the bug is exotic. Because of what the attacker did after the bug, which was almost entirely legitimate product functionality.

The patch that wasn't

The first vulnerability, CVE-2026-18556, is described by Horizon3.ai as improper enforcement of authentication controls through an alternate access path. Plain version: there was a way to reach the N-central management interface that skipped the checks the main path enforced. An unauthenticated attacker on the network could authenticate as an administrator without holding any credentials.

N-able patched it. The attacker found a variation that stepped around the new checks, and CVE-2026-18577 was assigned to what remained. Horizon3.ai's write-up is blunt about it: the original fix did not eliminate the underlying flaw.

That distinction matters more than the CVSS score anyone wants to argue about. A patch bypass tells you the person on the other end had the patch, diffed it, and worked out that the fix addressed a symptom rather than the control. That is not opportunistic scanning. That is someone sitting with the binary.

CISA added CVE-2026-18577 to the Known Exploited Vulnerabilities catalog on August 3 and CVE-2026-18556 two days later, per Rapid7's emergent threat report. Hotfix 1, build 2026.3.1.7, landed in the first days of August. By August 6 N-able was announcing a second hotfix, and build 2026.3.1.10 shipped on August 10, according to Help Net Security's running coverage. Ten days from first detection to a patch that held.

For an on-premise RMM server sitting at the top of an MSP's privilege chain, ten days is a long time.

Why the blast radius is different here

N-central is a remote monitoring and management platform. MSPs run it to administer the servers, workstations and network gear of their client base, which for a mid-sized provider means hundreds or thousands of downstream businesses. The agent it deploys runs with high privilege on every managed machine by design. That is the product working correctly.

So the arithmetic is ugly. Compromise one N-central server and you inherit privileged remote execution across every environment that server touches. Shodan searches referenced in reporting on the flaw put roughly 2,000 N-central instances on the public internet, with one count going above 3,000, concentrated in the United States, Australia and Germany. Not all of those are unpatched. Not all of them need to be.

This is the same structural problem I wrote about when defenders' own management tooling became the attack vector, and the same one that made the BeyondTrust privileged access compromise so painful. We keep centralising administrative reach into single products and then treating those products as infrastructure rather than as crown jewels.

What Storm-1175 actually did once inside

Sophos published telemetry from a customer compromised at roughly 08:00 UTC on August 3, and it reads like a well-rehearsed run. Sophos found a single affected organisation in its estate with no sign of wider compromise, so treat this as one detailed case rather than a population study. It is still the clearest picture available of the tradecraft.

After gaining administrative access to N-central, the actor used Take Control, the platform's built-in remote access feature, to reach managed endpoints. No exploit against the endpoints. No dropper. The RMM did the work it was built to do, for the wrong operator.

Then came reconnaissance that any red teamer would recognise:

• net user to enumerate accounts
• net group "domain admins" /domain to find the accounts worth having
• nltest /dclist to map domain controllers
• tasklist piped through findstr ms and findstr soph to work out which hosts were running Microsoft Defender or Sophos

That last one is the tell. Before touching credentials, the operator inventoried the defensive stack per host so they knew which machines needed handling. On the machines that did, Sophos observed a tool it calls PhantomKiller loading a driver named k.sys out of C:\ProgramData\AnyDesk, and the Sophos File Scanner process being terminated. Bring-your-own-driver, aimed squarely at the agent expected to catch this.

Credential access followed. Help Net Security's account of the campaign lists Mimikatz for credential dumping, password resets on existing domain administrator accounts, and the creation of a new domain account named veeam. Read that name again. It is not random. It is chosen to survive an account review, because a backup service account is exactly the kind of thing an admin scrolls past. I have used the same trick on engagements and nobody ever asks about it.

Persistence was Cloudflare Tunnel, installed and then renamed to MicrosoftEdgeUpdate64.exe or msmp.exe. That gives outbound-only command and control over a service most networks allow, surviving even if access to the N-central server is cut. On top of that the actor sprayed remote access tools across reachable endpoints: AnyDesk, TacticalRMM, TeamViewer, RustDesk, SimpleHelp and HopToDesk. Advanced IP Scanner handled network discovery.

Microsoft attributes this activity to Storm-1175, a financially motivated group running high-velocity ransomware operations that recently moved from Medusa to a payload called StormEncryptor. The recon-to-encryption pipeline here is short.

The sentence in N-able's advisory everyone should read twice

Buried in the guidance is the line that actually matters:

"Applying Hotfix 2 closes the vulnerability that allowed attackers in, but it does not remove a threat actor who may already be present."

N-able went further and told partners that if they applied either hotfix more than a few days after release, they should treat the environment as potentially compromised. The company also shipped an IoC scanning template while noting that a clean result is not a guarantee.

That is an honest advisory, and it says something uncomfortable. By the time the fix existed, the useful artefacts of the intrusion were no longer on the N-central server. They were a domain account called veeam, a reset admin password, a renamed cloudflared binary and six different remote access tools scattered across client estates. Patching removes the door. It does nothing about the furniture the intruder rearranged.

Every step after the exploit looked legitimate

Line up the post-exploitation activity and ask which part a detection rule catches cleanly.

Take Control is a sanctioned feature. net user and nltest are signed Windows binaries that admins run daily. Creating a domain account is normal in an MSP context where accounts get provisioned constantly. AnyDesk and TeamViewer are already whitelisted in most managed environments because the help desk uses them. Cloudflare Tunnel is a legitimate product, and it was renamed to look like an Edge updater. The one unambiguously malicious component, the EDR killer, exists specifically to remove the sensor that would have flagged the rest.

That is the pattern I keep coming back to. When the initial access is an authentication bypass and the follow-through is native tooling, behavioural detection is fighting on ground it does not own. I made this argument at length in the piece on why deception survives EDR killers, and Storm-1175 just ran the reference implementation.

Unit 42's 2026 Global Incident Response Report, drawn from more than 750 investigations, found identity weaknesses exploited in 89% of cases and identity-based techniques behind 65% of initial access. The N-central intrusion sits neatly inside both numbers. The vulnerability got the actor one identity. Everything expensive that followed came from the credentials that identity could reach.

Where a decoy would have interrupted this

I want to be careful here, because "our product would have stopped it" is a boring claim and usually a false one. So let me be specific about which steps in this exact chain touch bait, and which do not.

The exploit itself would not trip anything. An authentication bypass against an internet-facing management server is not something a honeytoken sees.

The reconnaissance is where it changes. net group "domain admins" /domain returns whatever is in that group. If a decoy administrator account sits in the results, an actor building a target list from that output has no way to distinguish it from a real one, and the only way to test it is to use it. That single authentication attempt is unambiguous. Nobody legitimate ever authenticates as an account that exists purely as bait, which is why these alerts carry no false positive tail.

Credential dumping is the same story from a different angle. Mimikatz scrapes what is in memory and in the credential store. Salt that surface with credentials that map to nothing real, and the dump becomes a liability for the person holding it. The trigger fires at use, not at theft, which is the whole point: you find out at the moment the stolen material is exercised rather than when the ransom note lands.

Then there is Advanced IP Scanner. An actor sweeping a subnet builds a picture from what answers. MineField's decoy TCP services put listeners in that picture that have no business being connected to. A scan is noisy but not alerting on its own. A connection into a service that exists only to be discovered is a different signal entirely.

And the veeam account deserves its own note. The attacker created a fake service account to blend in. The defensive mirror image of that move is to already have plausible service account credentials planted where an intruder will find them, which is the argument I made about service accounts as the lateral movement blind spot. Both sides are exploiting the same fact: nobody audits service accounts closely, and everybody trusts them.

None of this replaces patching. It changes what happens during the ten days between first exploitation and a fix that holds, and during the longer stretch afterward when the actor is still resident and the advisory has already told you patching will not remove them.

If you run N-central, or your MSP does

Get to build 2026.3.1.10. Hotfix 2 supersedes Hotfix 1, so applying the first one is not sufficient. Hosted environments were patched by the vendor. On-premise is on you.

Then work the assumption that you were reached. Audit domain accounts created since late July, with attention to anything named after a backup or monitoring product. Check for password resets on privileged accounts that nobody can attribute to a ticket. Hunt for cloudflared, including under names like MicrosoftEdgeUpdate64.exe and msmp.exe, and for a suspicious svchost.exe sitting in a user's Documents folder, which Rapid7 lists among the endpoint indicators. Inventory remote access tools across managed endpoints and treat any RMM agent your team did not deploy as an intrusion until proven otherwise. Pull N-able's published IP indicators, expanded with those from Sophos and others, and run them against perimeter logs going back to July 31.

One more thing, and it is the part most teams skip. Ask how you would have known. If the honest answer is that you would have found out when the encryption started, that gap is not going to be closed by faster patching, because Storm-1175 was inside before a working patch existed. It gets closed by having something in the environment that an intruder cannot help but touch and a legitimate user never will. If you want to see what that looks like against a live intrusion path rather than in a slide, book a walkthrough with our team and we will map the decoys to the exact recon steps in this timeline.