Storm-1175 Switches to a New Ransomware Strain, StormEncryptor

Microsoft has disclosed activity by the financially motivated group Storm-1175, which is linked to China: the attackers have begun deploying a previously unknown ransomware called StormEncryptor. According to Microsoft Threat Intelligence, this is a notable shift — the group had previously relied on the Medusa ransomware.

What the malware is

StormEncryptor is written in C++; it appends the .encrypted extension to encrypted files and drops a ransom note named !!!README_FIRST!!!.txt into every directory it scans. Microsoft laid this out in a series of posts on Bluesky.

The exact vulnerability used for the intrusion has not yet been established, but the company believes it most likely involves the exploitation of CVE-2026-18577 — a recently disclosed flaw in N-able's N-central product. This flaw is assessed as a patch bypass for CVE-2026-18556; both allow authentication to be bypassed and an account to be taken over in vulnerable versions. The U.S. agency CISA has already flagged them as being actively exploited.

The group's hallmarks

Storm-1175 is known for combining zero-day vulnerabilities with so-called N-days — those that have already been disclosed but not yet closed by updates. The group bets on speed and on the gap between the publication of a vulnerability and the deployment of patches. Its track record includes the exploitation of flaws in Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity and Fortinet FortiClient EMS, as well as, according to Microsoft's October 2025 report, in Fortra GoAnywhere.

Once inside, the group moves fast. Microsoft notes the abuse of the AnyDesk and SimpleHelp remote monitoring and management tools, the use of Advanced IP Scanner for reconnaissance, and the extraction of credentials from the memory of the LSASS process using Mimikatz. From initial access to data theft and the launch of the ransomware, often only a few days pass.

That speed means one thing: updates need to be installed as quickly as possible — the window in which a patch has not yet been applied is precisely Storm-1175's primary attack vector.

Source: The Hacker News