Microsoft says China-linked Storm-1175 is using a new ransomware called StormEncryptor, replacing Medusa in its latest attacks.

Microsoft says China-linked, financially motivated threat actor Storm-1175 has begun using a new ransomware strain called StormEncryptor. The group previously relied on Medusa ransomware. StormEncryptor is written in C++ and encrypts files and adds the .encrypted extension, then leaves a !!!README_FIRST!!!.txt ransom note in each scanned directory. The change suggests an evolution in the group’s ransomware operations.

“While Microsoft has not confirmed the vulnerability targeted by Storm-1175 in this campaign, the threat actor is likely exploiting the CVE-2026-18577 authentication bypass vulnerability in N-able, which was disclosed on August 2, 2026 and added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026.” wrote Microsoft on X.

Storm-1175 is known for fast ransomware campaigns that exploit newly disclosed vulnerabilities before organizations can patch them. In recent attacks, the group used tools such as AnyDesk and SimpleHelp for remote access, Advanced IP Scanner to map networks, and Mimikatz to dump LSASS credentials.

Microsoft says the attackers can move from initial access to data theft and ransomware deployment within days, highlighting the need for rapid patching and monitoring.

China-based actor Storm-1175 carries out fast, financially driven ransomware attacks by exploiting newly disclosed vulnerabilities before organizations patch them. The group targets exposed systems and quickly moves from initial access to data theft and ransomware deployment, sometimes within 24 hours. The financially motivated group mainly targets sectors such as healthcare, education, finance, and services across the US, UK, and Australia. The attackers often chain exploits, create new accounts for persistence, move laterally using remote tools, steal credentials, and weaken security defenses. Their speed and focus on unpatched systems make them highly effective.

Microsoft researchers report that the group quickly exploits newly disclosed flaws in web-facing systems to gain access. Since 2023, the group has targeted many platforms, including Microsoft Exchange, Ivanti, ConnectWise, JetBrains, and others. It often weaponizes vulnerabilities within days, or even one day, before organizations apply patches.

“Storm-1175 rapidly weaponizes recently disclosed vulnerabilities to obtain initial access.” reads the report published by Microsoft. “Since 2023, Microsoft Threat Intelligence has observed exploitation of over 16 vulnerabilities, including:

• CVE-2026-1731 (BeyondTrust)”
• CVE-2023-21529 (Microsoft Exchange)
• CVE-2023-27351 and CVE-2023-27350 (Papercut)
• CVE-2023-46805 and CVE-2024-21887 (Ivanti Connect Secure and Policy Secure)
• CVE-2024-1709 and CVE-2024-1708 (ConnectWise ScreenConnect)
• CVE-2024-27198 and CVE-2024-27199 (JetBrains TeamCity)
• CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 (SimpleHelp)
• CVE‑2025‑31161 (CrushFTP)
• CVE-2025-10035 (GoAnywhere MFT)
• CVE-2025-52691 and CVE-2026-23760 (SmarterMail)

The attackers also chain multiple exploits to achieve deeper access, such as remote code execution, and have targeted both Windows and Linux systems. In some cases, the threat actor used zero-days even before public disclosure, showing advanced capabilities. By focusing on unpatched systems and acting fast, Storm-1175 maximizes impact and maintains a strong advantage over defenders.

Storm-1175 chains multiple exploits to gain deeper access, as seen in attacks on Microsoft Exchange where it moved from initial access to remote code execution. The group also targets Linux systems and has used zero-day flaws before public disclosure, showing advanced skills.

After gaining access, it installs web shells or remote tools, creates admin accounts, and moves laterally using tools like PowerShell, PsExec, RDP, and Cloudflare tunnels. It also abuses legitimate RMM tools and software like PDQ Deployer and Impacket to spread across networks. The attackers can deploy ransomware in as little as one day, highlighting their speed and efficiency.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)

Cisco warns that seven ClamAV flaws affect Secure Endpoint Connector products, with two having public PoCs that could enable remote DoS attacks.

Cisco warned that seven ClamAV vulnerabilities affect its Secure Endpoint Connector on Windows, macOS and Linux. ClamAV is an open-source antivirus engine widely used to scan files and emails for malware.

The company states that two flaws have public PoCs and could let unauthenticated attackers cause DoS conditions.

“Multiple vulnerabilities in ClamAV could allow a remote attacker to cause a denial of service (DoS) condition, interrupting scanning operations.” reads the advisory.

The flaws, tracked as CVE-2026-20337 to CVE-2026-20339 and CVE-2026-20345 to CVE-2026-20348, affect ClamAV parsers for several file formats. ClamAV fixed them in version 1.5.4, Cisco later warned that public PoCs are available for the vulnerabilities CVE-2026-20337 and CVE-2026-20338. Company’s PSIRT said it has no evidence that attackers have exploited these vulnerabilities in the wild.

“”The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerabilities that are described in CVE-2026-20337 and CVE-2026-20338.The Cisco PSIRT is not aware of proof-of-concept exploit code for any of the other vulnerabilities that are described in this advisory.” continues the advisory. “The Cisco PSIRT is not aware of any malicious use of the vulnerabilities that are described in this advisory.”

Below are the descriptions of CVE-2026-20337 and CVE-2026-20338:

• CVE-2026-20337 (CVSS score of 7.5) – CVE-2026-20337: ClamAV Zip File Format Processing Out-of-Bounds Write Vulnerability – A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper boundary checks for content in zip files during scanning, which may result in an out-of-bounds write condition. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate, resulting in a DoS condition on the affected software.
• CVE-2026-20337 (CVSS score of 7.5) – ClamAV Zip File Format Processing Memory Corruption Vulnerability – A vulnerability in the zip archive parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This vulnerability is due to improper memory handling when processing content in zip files during scanning. An attacker could exploit this vulnerability by submitting a crafted zip file for scanning. A successful exploit could allow the attacker to cause the ClamAV scanning process to terminate as a result of a memory double-free, resulting in a DoS condition on the affected software.

Cisco identified the affected products in its advisory and recommends customers check the related bug IDs for details on each vulnerability.

Secure Endpoint Private Cloud is not affected, but must distribute the fixes to endpoints.

Cisco said no workaround is available. Patches will be released in August. The flaws are high risk on Windows because ClamAV runs with elevated privileges, while macOS and Linux face medium risk.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, newsletter)

USB .lnk malware steals crypto via clipboard hijack, replaces wallet addresses, steals seed phrases, and screenshots.

Microsoft Threat Intelligence has been tracking a clipboard-stealing malware (Clipper) campaign since February 2026 that targets cryptocurrency wallets. A clipper is a type of malicious software that monitors and manipulates your clipboard, the temporary memory where data is stored when you copy and paste.

It spreads through malicious shortcut files on USB drives, hides its command server inside the Tor network, and can replace wallet addresses in your clipboard before you paste them. The attacker collects the crypto; you collect the confusion.

What makes it harder to spot is that this clipper doesn’t use a traditional installer or expose any real IP addresses. It ships with its own Tor client, routes traffic through a local proxy on port 9050, and resolves everything to .onion domains inside Tor.

“The clipper in this campaign relies on Windows Script Host and ActiveX-driven logic to launch a bundled Tor proxy and poll a hidden-service C2 server. It carries out high-frequency clipboard theft, screenshot exfiltration, and wallet-address substitution.” reads the report published by Microsoft. “The execution of this clipper is notable because it does not depend on a traditional installer or exposed IP-based C2 infrastructure. Instead, it deploys a portable Tor client, routes traffic through a local SOCKS5 proxy, and blends data theft with remote code execution, turning a financially motivated stealer into a lightweight backdoor.”

The attack chain starts when someone opens a .lnk shortcut file from a USB drive. The malware then scans the device for document files like .doc, .xlsx, and .pdf, hides the originals, and replaces them with malicious shortcuts carrying the same names. Open what you think is a spreadsheet and you’re running malware. It also sets up scheduled tasks to copy itself onto any new USB drive that gets plugged in.

Malware steals crypto data from clipboard by capturing BIP39 seed phrases and private keys, exfiltrates via Tor, and sends screenshots for context.

“The malware detects 12 or 24-word BIP39 seed phrases in clipboard data. It saves the seed to local file (GOOD path) as a backup and exfiltrates it to the C2 domain via Tor.” states the report. “It retries network transmission until it is acknowledged and deletes local backup after successful transmission.”

Beyond seed phrases, it also grabs Ethereum and Bitcoin WIF private keys, and checks the clipboard every 500 milliseconds for wallet addresses across Bitcoin, Ethereum, Tron, and Monero. When it finds one, it swaps it out for an attacker-controlled address that partially resembles the original, so a quick glance won’t catch the swap.

The stealer also takes five screenshots every ten seconds and sends them over Tor, giving the attacker a live view of what the victim is doing with their wallet. There’s also a remote code execution channel: the C2 can send an EVAL instruction, the malware downloads JavaScript into a file called “cfile,” and runs it. That turns what looks like a simple crypto thief into something with full backdoor potential.

Microsoft researchers highlight that all the malware components are encrypted and only decrypted at runtime, wrapped in PyArmor-obfuscated Python and packaged with PyInstaller. The JavaScript payloads get two layers of obfuscation on top of that. It also checks for Task Manager before doing anything, and exits if it’s running.

“For defenders, the strongest signals are behavioral: script interpreters spawning suspicious child processes, localhost:9050 proxy usage, screen-capture commands in PowerShell, and signs of clipboard inspection or crypto-address replacement.” Microsoft continues.

Microsoft Defender for Endpoint detects components of this threat and flags it as Trojan:Win32/CryptoBandits.A. If you’re handling any sensitive financial workflows, monitoring wscript.exe and cscript.exe activity and blocking .lnk execution from removable drives via Group Policy are the right places to start.

“This malware family shows how lightweight, script-based stealers can deliver outsized impact when paired with anonymized communications and runtime tasking.” concludes the report. “The combination of Tor-routed C2, clipboard targeting, screenshot capture, and remote code execution gives attackers both immediate monetization paths and continued control over compromised devices.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, clipper)