Back Blogs.Microsoft

Storm-1175 focuses gaze on vulnerable web-facing assets in high

Blogs.Microsoft •Microsoft Threat Intelligence • April 6, 2026

The financially motivated cybercriminal threat actor Storm-1175 operates high-velocity ransomware campaigns that weaponize recently disclosed vulnerabilities to obtain initial access, exfiltrate data, and deploy Medusa ransomware (Gaze.exe).

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ransomware Fuels Surge in Global Cyberattacks As of February 12, 2026, organizations worldwide are experiencing an average of 2,090 cyber-attacks per week, largely driven by ransomware incidents. This increase highlights the ongoing challenges faced by businesses in securing their networks against evolving cyber threats. 1922 sources 64

Extracted Entities

Storm-1175 focuses gaze on vulnerable web-facing assets in high

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Ransomware Groups (2)

Tools (1)