🟠 High | Source: The Hacker News
Microsoft has identified a China-linked financially motivated threat actor, Storm-1175, deploying a new ransomware strain called StormEncryptor, believed to be delivered via a vulnerability in N-central, an IT management platform. Written in C++ and appending the ‘.encrypted’ extension to files, StormEncryptor represents a shift away from the group’s previous use of Medusa ransomware. This is notable because it signals the group is developing bespoke tooling, making detection and attribution more complex.
Security Architect’s Take: Prioritise patching N-central instances immediately and audit any systems managed via N-central for signs of lateral movement or unauthorised file encryption. Additionally, review endpoint detection rules to ensure coverage for novel ransomware strains, particularly those not yet in commercial threat intelligence feeds.
Original advisory: China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw