Storm-1175 Replaces Medusa with New StormEncryptor Ransomware
China-linked hacker group continues attacks with a new ransomware strain.
1New Ransomware: StormEncryptor
Microsoft revealed that the China-linked Storm-1175 group has switched from using Medusa ransomware to a new variant called StormEncryptor. Written in C++, this malware encrypts files, appends a .encrypted extension, and leaves a !!!README_FIRST!!!.txt ransom note in each directory. This shift indicates an evolution in the group's ransomware operations. Microsoft suggested the group likely exploits the CVE-2026-18577 authentication bypass vulnerability disclosed on August 2, 2026.
2Rapid and Effective Attacks
Storm-1175 quickly exploits newly disclosed vulnerabilities before organizations can patch them. Recent attacks involved tools like AnyDesk and SimpleHelp for remote access, Advanced IP Scanner for network mapping, and Mimikatz for stealing LSASS credentials. Microsoft emphasized that attackers can progress from initial access to data theft and ransomware deployment within days, underscoring the need for swift patching and monitoring.
3Targeted Sectors and Regions
Storm-1175 primarily targets healthcare, education, finance, and service sector organizations in the US, UK, and Australia for financial gain. The group rapidly exploits vulnerabilities, creates new accounts for persistence, and uses remote tools to move laterally. Their ability to weaken security defenses and execute attacks within hours makes them highly effective and dangerous.
4Exploited Vulnerabilities
Microsoft reported that Storm-1175 has exploited over 16 vulnerabilities since 2023, including flaws in Microsoft Exchange, Ivanti, ConnectWise, and JetBrains platforms. The group has even weaponized zero-day vulnerabilities before public disclosure, demonstrating advanced capabilities. Their speed in exploiting newly disclosed flaws highlights the need for proactive security measures.
5Attack Methods and Tools
Storm-1175 chains multiple exploits to achieve deeper access, targeting both Windows and Linux systems. The group deploys web shells or remote tools, creates admin accounts, and moves laterally using PowerShell, PsExec, and RDP. They also abuse legitimate software like PDQ Deployer and Impacket to spread across networks. Ransomware deployment can occur in as little as one day, showcasing their efficiency.
6Importance of Rapid Patching and Monitoring
Microsoft stresses the critical need for organizations to patch vulnerabilities quickly and maintain continuous monitoring due to Storm-1175's speed and effectiveness. The group's ability to exploit new flaws almost immediately challenges security teams to respond in time. Proactive measures and robust incident response plans are essential to mitigate risks.
7Impact on Targeted Industries
Healthcare, education, and finance sectors, frequently targeted by Storm-1175, are particularly vulnerable to ransomware attacks. Operational disruptions and data losses in these sectors can have severe consequences. The group's sophisticated methods necessitate a reevaluation of security strategies, with additional protections recommended for critical infrastructure.
8Future Threats and Mitigation Strategies
Storm-1175's advanced capabilities and rapid attack strategies suggest ransomware threats will continue to grow. Organizations must regularly scan for vulnerabilities, apply patches promptly, and adopt multi-layered defense strategies. Enhancing employee cybersecurity awareness and updating incident response plans are also crucial steps to counter evolving threats.
Original article: Security Affairs — Storm-1175, Medusa Yerine StormEncryptor Ransomware Kullanıyor