NEW STORMENCRYPTOR RANSOMWARE USED BY FORMER MEDUSA AFFILIATE

Summary from the TLDR InfoSec newsletter

Microsoft Threat Intelligence is tracking a financially motivated threat actor that was previously affiliated with the Medusa ransomware operation and is currently deploying a new ransomware strain called StormEncryptor. The threat actor has been exploiting vulnerabilities in the N-Central RMM software to breach systems, followed by using AnyDesk or SimpleHelp for remote management, Advanced IP Scanner for network discovery, and Mimikatz for credential dumping. The StormEncryptor ransomware is a C++ malware that appends encrypted files with the “.encrypted” extension and drops a ransom note, which gives victims three days to negotiate with the attackers before data is leaked, in each scanned directory.