StormEncryptor ransomware Emerges: China‑Linked Hackers Target N‑central Vulnerability

StormEncryptor ransomware Exploits N‑central Flaw

Microsoft’s threat intel team has identified a new financially motivated actor, dubbed Storm‑1175, linked to Beijing, deploying StormEncryptor ransomware. Unlike its predecessor Medusa, the payload is written in C++ and appends a .encrypted extension to compromised files.

“The shift to StormEncryptor signals a maturation of the group’s toolkit,” said a Microsoft spokesperson.

The campaign appears to leverage a zero‑day in the N‑central remote‑management platform, allowing lateral movement across enterprise networks. Early estimates suggest a ↑ 5% rise in ransomware variants targeting similar infrastructure this quarter.

Analysts warn that the threat actor’s focus on high‑value targets could amplify extortion demands, potentially adding ↓ 2 to the average ransom payout compared to prior attacks.

For further context, see Reuters and Bloomberg.

Analysis by: Kaelen Frost

Lead Cybersecurity Analyst