A prolific cybercrime group has been weaponizing n-day and zero-day exploits in high-tempo Medusa ransomware attacks over the past three years, Microsoft has revealed.
Storm-1175 is a financially motivated actor that usually exploits the window between vulnerability disclosure and patch adoption, Microsoft said in a blog post on April 6.
“The threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the UK and US,” it said.
The group has exploited at least 16 vulnerabilities in this way since 2023, including three zero-day flaws such as CVE-2025-10035. That vulnerability in GoAnywhere Managed File Transfer, was exploited one week before public disclosure last year.
Microsoft pointed to several typical TTPs used by Storm-1175:
Microsoft said the group has already exploited vulnerabilities in Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, GoAnywhere MFT, SmarterMail and BeyondTrust.
To mitigate the threat of attack, organizations should first use perimeter scanning tools to understand the extent of their attack surface, Microsoft recommended. Web-facing systems should be isolated from the public internet with a secure network boundary and accessed only via a virtual private network (VPN).
If they must be connected, organizations should place these systems behind a web application firewall (WAF), reverse proxy, or perimeter network (aka DMZ), the report continued.
Microsoft also recommended :
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
