China‑Linked Hackers Deploy StormEncryptor Ransomware

Microsoft’s Threat Intelligence Team announced that a financially motivated actor known as Storm‑1175—identified in the past as linked to China—has deployed a previously undocumented ransomware strain called StormEncryptor ¹. The new malware marks a shift from the group’s earlier use of Medusa ransomware and is written entirely in C++, which allows for tighter memory control and higher execution speed than older languages typically used by state‑backed adversaries.

The code appends the file name extension “​.encrypted” to every victim file it targets, making the encrypted files immediately recognizable on disk while also obfuscating them from casual inspection. This naming scheme mirrors tactics seen in other fast‑encryption tools, and the choice of C++ indicates an emphasis on performance over stealth—a hallmark of financially driven groups who prioritize rapid data lockup before victims can mount defenses.

According to Microsoft, the attackers likely leveraged a flaw in N‑central, a remote management platform that had already attracted repeated attacks after a public vulnerability was disclosed last July 2024. By exploiting this pathway, the actors could gain initial footholds inside target environments with minimal detection risk, then deploy the StormEncryptor payload to encrypt critical documents and demand ransom payments ¹.

C++’s low‑level capabilities give these threat actors the ability to fine‑tune encryption loops, reducing CPU overhead compared to interpreted or higher‑level languages. The result is faster encryption times, allowing more systems to be compromised within limited windows before backup checks or intrusion alerts trigger.

The emergence of StormEncryptor underscores how quickly new variants can surface even from well‑known threat actor families. While Medusa relied heavily on obfuscation and complex delivery chains, the newer strain’s lean design demonstrates that speed alone can make a ransomware campaign successful if combined with an accessible exploitation vector like N‑central. For organizations using such platforms, the lesson is clear: keep software up‑to‑date, enforce least‑privilege access controls, and employ file‑integrity monitoring to catch unexpected renaming patterns before data loss becomes irreversible.