Microsoft Says China-Linked Storm-1175 Deploys New StormEncryptor Ransomware
Summary
Microsoft says China-linked Storm-1175 has switched from Medusa to StormEncryptor and may be exploiting an N-central flaw. The group uses remote-management and discovery tools before rapidly exfiltrating data and deploying ransomware.
Key points
- Microsoft reports that Storm-1175, a financially motivated actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor, replacing its earlier use of Medusa.
- StormEncryptor is written in C++, appends .encrypted to encrypted files, and drops a !!!README_FIRST!!!.txt ransom note in scanned directories.
- Microsoft says the campaign may exploit CVE-2026-18577 in N-able N-central for initial access; the exact vulnerability used remains unclear.
- The article describes CVE-2026-18577 as a likely patch bypass for CVE-2026-18556; both flaws allow authentication bypass and account takeover in susceptible versions and were flagged by CISA as actively exploited.
- Post-compromise activity includes AnyDesk or SimpleHelp, Advanced IP Scanner for discovery, and Mimikatz for LSASS dumping.
- Microsoft says Storm-1175 can move from initial access to data exfiltration and ransomware deployment within a few days, and urges customers to apply patches.
Article Details
- Event Type
- Ransomware campaign involving Storm-1175's deployment of a previously undocumented ransomware strain.
- Impact
- The campaign involves intrusion, data exfiltration, and encryption of affected systems. StormEncryptor appends .encrypted to encrypted files and drops a ransom note in scanned directories.
MITRE ATT&CK
T1003.001 · LSASS MemoryThe article reports LSASS dumping using Mimikatz.T1046 · Network Service DiscoveryAdvanced IP Scanner was used for discovery after compromise.T1190 · Exploit Public-Facing ApplicationStorm-1175 likely exploited a flaw in N-central to gain initial access to internet-facing systems.T1219 · Remote Access ToolsThe article reports abuse of AnyDesk or SimpleHelp for post-compromise remote monitoring and management.T1486 · Data Encrypted for ImpactStormEncryptor encrypts files during the ransomware activity.
CVE
Threat Actors
Malware
MedusaMicrosoft says Storm-1175, a China-linked financially motivated threat actor, has switched from Medusa to a new ransomware strain called StormEncryptor.StormEncryptorMicrosoft says Storm-1175, a China-linked financially motivated threat actor, has switched from Medusa to a new ransomware strain called StormEncryptor.
Vendors
Products
AnyDeskThe campaign likely abuses a newly disclosed N-able N-central flaw for access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz before quickly exfiltrating data and encrypting systems.N-centralThe campaign likely abuses a newly disclosed N-able N-central flaw for access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz before quickly exfiltrating data and encrypting systems.SimpleHelpThe campaign likely abuses a newly disclosed N-able N-central flaw for access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz before quickly exfiltrating data and encrypting systems.
Tools
Advanced IP ScannerThe campaign likely abuses a newly disclosed N-able N-central flaw for access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz before quickly exfiltrating data and encrypting systems.MimikatzThe campaign likely abuses a newly disclosed N-able N-central flaw for access, then uses tools like AnyDesk, SimpleHelp, Advanced IP Scanner, and Mimikatz before quickly exfiltrating data and encrypting systems.