Evolving Threat: StormEncryptor ransomware Targets Mid‑Size Firms After Medusa Split

Former members of the Medusa ransomware collective have launched a fresh threat dubbed StormEncryptor ransomware, targeting mid‑size enterprises across Europe and North America.

StormEncryptor ransomware emerges from Medusa split

The new strain encrypts files with a double‑layer algorithm, then demands payment in Bitcoin within 48 hours. Security firms note a ↓ 20% dip in average ransom amounts, yet the number of infections has risen ↑ 5 since its debut in early June. Analysts warn that the actors behind the campaign retain the same monetisation infrastructure that powered Medusa, allowing rapid deployment of fresh loaders.

“We are observing a rapid shift in tactics, with attackers leveraging more aggressive lateral movement,” said a senior researcher at Reuters.

The codebase incorporates a self‑deleting dropper, making forensic recovery arduous. Victims are urged to isolate affected systems, enforce multi‑factor authentication, and keep backups offline. For deeper insight, see the latest threat‑intel brief from Bloomberg.

Dispatch from: Nova Stirling

Aerospace & Space Tech Correspondent