# China-Linked Hackers Deploy New StormEncryptor Ransomware Microsoft reveals likely exploitation of N-central security flaw for distribution. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-08-10 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/9d8b9d71-b7ed-40de-b0c4-20ef372e265b ## New Ransomware: StormEncryptor Microsoft disclosed that China-linked threat actor Storm-1175 has begun using a new ransomware strain called StormEncryptor. The malware is written in C++ and appends .encrypted extension to files. It drops a ransom note named !!!README_FIRST!!!.txt in every encrypted directory. This marks a shift from the group's previous use of Medusa ransomware in their attacks. ## N-central Vulnerability Exploitation The distribution of StormEncryptor is believed to exploit CVE-2026-18577, a security flaw in N-able N-central software. This vulnerability allows authentication bypass and account takeover. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of this flaw. The vulnerability is assessed as a patch bypass for a previous security fix. ## Storm-1175's Track Record Storm-1175 has previously deployed Medusa ransomware by exploiting vulnerabilities in Mirth Connect, ConnectWise ScreenConnect, JetBrains TeamCity, and Fortinet FortiClient EMS systems. In October 2025, Microsoft also reported the group exploiting a critical flaw in Fortra GoAnywhere (CVE-2025-10035). The actor combines zero-day and N-day vulnerabilities to conduct rapid attacks against internet-facing systems. ## Attack Techniques In compromised systems, Storm-1175 abuses remote monitoring tools like AnyDesk or SimpleHelp. They conduct reconnaissance using Advanced IP Scanner and perform LSASS dumping with Mimikatz. The group typically moves from initial access to data exfiltration and ransomware deployment within days. This rapid timeline makes prompt patching absolutely critical for potential targets. ## Importance of Patching Microsoft strongly recommends that users apply security patches as soon as possible. Storm-1175's attacks specifically target the window between vulnerability disclosure and patch implementation. Internet-exposed systems are particularly vulnerable to such attacks. Organizations need to accelerate their patch management processes to defend against these high-velocity threats. ## Ransomware Impacts Ransomware like StormEncryptor can force organizations to halt operations and suffer significant data loss. Paying ransoms further incentivizes cybercriminals to conduct more attacks. Data breaches also erode customer trust, causing long-term brand damage. These consequences make proactive security measures essential for all organizations handling sensitive data. ## Industry-Wide Threats Ransomware attacks have increased in both frequency and sophistication in recent years. Global ransom payments exceeded $1 billion in 2025. Beyond Storm-1175, Russia-linked groups employ similar tactics. The healthcare, finance, and energy sectors remain prime targets. Organizations must develop multi-layered security strategies to counter these evolving threats. ## Recommended Defenses Organizations should implement regular offline backups as protection against ransomware. Multi-factor authentication should be widely adopted. Staff must receive cybersecurity awareness training. Network segmentation can help reduce attack surfaces. Regular vulnerability scanning and penetration testing should be conducted to identify weaknesses before attackers do. ## Sources covering this story - https://thehackernews.com/2026/08/china-linked-hackers-deploy-new.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._