New StormEncryptor ransomware used by former Medusa affiliate

Microsoft tracks China-based threat actor Storm-1175 deploying new C++ ransomware StormEncryptor, a shift from Medusa. Attacks likely exploited N-able N-central flaw CVE-2026-18577. The malware appends.encrypted and drops!!!README_FIRST!!!.txt, giving victims three days before data leaks.