MICROSOFT has reported that the China-linked cybercriminal group Storm-1175 has replaced its previous ransomware, Medusa, with a new strain known as StormEncryptor. This ransomware encrypts files and appends a `.encrypted` extension, along with leaving a ransom note in affected directories. Storm-1175 exploits vulnerabilities, particularly targeting a described CVE-2026-18577 in N-able, previously undisclosed.
The group is known for its rapid attacks, often moving from initial access to data theft and ransom within days, using tools like AnyDesk and Mimikatz. With a focus on vulnerable systems in sectors such as healthcare and finance across the US, UK, and Australia, Storm-1175 has been able to maximize its effectiveness by quickly deploying ransomware and leveraging newly disclosed flaws.
In its operations, the group has exploited over 16 vulnerabilities in prominent platforms since 2023, demonstrating advanced capabilities, including exploiting zero-day vulnerabilities before they are publicly acknowledged.