Back Therecord.Media

Medusa ransomware group using zero-days to launch attacks within 24 hours of breach, Microsoft says

Therecord.Media • April 6, 2026

Microsoft said it has been alarmed to see how effective Medusa actors are, citing multiple cases where the group can move from initial access to data exfiltration and ransomware deployment within 24 hours.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Storm-1175 Group Launches Rapid Medusa Ransomware Attacks Microsoft has identified a new cybercriminal group, Storm-1175, responsible for swift Medusa ransomware attacks targeting the healthcare and education sectors in the UK, US, and Australia. The group exploits zero-day vulnerabilities, allowing them to transition from initial access to data exfiltration and ransomware deployment within 24 hours. This alarming efficiency has raised significant concerns among cybersecurity experts. The attacks leverage security flaws that have not yet been disclosed, indicating a high level of sophistication in their methods. Microsoft has reported multiple incidents where organizations were compromised and held for ransom in a matter of hours. The exact number of affected organizations remains unspecified, but the scope of impact is considerable given the critical nature of the targeted sectors. As of now, there are no known patches or mitigations available for the vulnerabilities being exploited. The situation is ongoing, with Microsoft urging organizations to bolster their defenses against potential breaches. 7 sources 64

Medusa ransomware group using zero-days to launch attacks within 24 hours of breach, Microsoft says

The full story

Extracted Entities

Attack Types (1)

Ransomware Groups (1)