HIGHRansomware
Global

China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw

·Source: The Hacker News

Updated:

Executive Summary

Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware, the Microsoft Threat Intelligence Team said. "StormEncryptor is written in C++ and appends the file name extension .encrypted

Analysis

Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor. The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware, the Microsoft Threat Intelligence Team said. "StormEncryptor is written in C++ and appends the file name extension .encrypted
Source Attribution

Originally published by The Hacker News on Aug 10, 2026.

Related Threats

HIGHRansomware

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. [...]

BleepingComputer
HIGHRansomware

Akira Affiliate Crashes Ransomware After Attempting EDR Evasion

Huntress documents how a ransomware affiliate sabotaged its own attack with an anti-EDR effort

Infosecurity Magazine
HIGHRansomware

AnMed Faces Continued Ransomware as Attacker Ramps Up Pressure

AnMed has not disclosed the name of the group behind the attack, but a threat group called The Gentlemen claimed […] The post AnMed Faces Continued Ransomware as Attacker Ramps Up Pressure appeared first on The HIPAA Journal .

HIPAA Journal