Microsoft Warns of Storm1175 Ransomware Attacks

Microsoft has issued a warning about a China-based cybercrime group known as Storm1175, which has conducted rapid ransomware attacks using the Medusa strain, often completing intrusions from initial access to data exfiltration and encryption within 24 hours. The financially motivated actors, active since 2023, primarily target healthcare, education, finance, and professional services organizations in the United States, United Kingdom, and Australia, exploiting unpatched vulnerabilities in web-facing systems to gain entry.

According to Microsoft's Threat Intelligence report, Storm1175 operates with high efficiency, weaponizing newly disclosed flaws in products such as Microsoft Exchange, Ivanti Connect Secure, ConnectWise ScreenConnect, JetBrains TeamCity, and others. The group has exploited more than 16 vulnerabilities since 2023, including chaining multiple exploits to achieve remote code execution and deeper network access. In some instances, they have used zero-day flaws, such as those in GoAnywhere Managed File Transfer (CVE-2025-10035) and SmarterMail (CVE-2026-23760), up to a week before public disclosure. The actors have also targeted Linux systems, including Oracle...