China-Linked Hackers Deploy New StormEncryptor Ransomware
Microsoft reveals likely exploitation of N-central security flaw for distribution.
1New Ransomware: StormEncryptor
Microsoft disclosed that China-linked threat actor Storm-1175 has begun using a new ransomware strain called StormEncryptor. The malware is written in C++ and appends .encrypted extension to files. It drops a ransom note named !!!README_FIRST!!!.txt in every encrypted directory. This marks a shift from the group's previous use of Medusa ransomware in their attacks.
2N-central Vulnerability Exploitation
The distribution of StormEncryptor is believed to exploit CVE-2026-18577, a security flaw in N-able N-central software. This vulnerability allows authentication bypass and account takeover. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of this flaw. The vulnerability is assessed as a patch bypass for a previous security fix.
3Storm-1175's Track Record
Storm-1175 has previously deployed Medusa ransomware by exploiting vulnerabilities in Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, and Fortinet FortiClient EMS systems. In October 2025, Microsoft also reported the group exploiting a critical flaw in Fortra GoAnywhere (CVE-2025-10035). The actor combines zero-day and N-day vulnerabilities to conduct rapid attacks against internet-facing systems.
4Attack Techniques
In compromised systems, Storm-1175 abuses remote monitoring tools like AnyDesk or SimpleHelp. They conduct reconnaissance using Advanced IP Scanner and perform LSASS dumping with Mimikatz. The group typically moves from initial access to data exfiltration and ransomware deployment within days. This rapid timeline makes prompt patching absolutely critical for potential targets.
5Importance of Patching
Microsoft strongly recommends that users apply security patches as soon as possible. Storm-1175's attacks specifically target the window between vulnerability disclosure and patch implementation. Internet-exposed systems are particularly vulnerable to such attacks. Organizations need to accelerate their patch management processes to defend against these high-velocity threats.
6Ransomware Impacts
Ransomware like StormEncryptor can force organizations to halt operations and suffer significant data loss. Paying ransoms further incentivizes cybercriminals to conduct more attacks. Data breaches also erode customer trust, causing long-term brand damage. These consequences make proactive security measures essential for all organizations handling sensitive data.
7Industry-Wide Threats
Ransomware attacks have increased in both frequency and sophistication in recent years. Global ransom payments exceeded $1 billion in 2025. Beyond Storm-1175, Russia-linked groups employ similar tactics. The healthcare, finance, and energy sectors remain prime targets. Organizations must develop multi-layered security strategies to counter these evolving threats.
8Recommended Defenses
Organizations should implement regular offline backups as protection against ransomware. Multi-factor authentication should be widely adopted. Staff must receive cybersecurity awareness training. Network segmentation can help reduce attack surfaces. Regular vulnerability scanning and penetration testing should be conducted to identify weaknesses before attackers do.