A Chinese cyber threat group known for using Medusa ransomware has been found to be exploiting both new and recently patched vulnerabilities in order to quickly attack and infiltrate vulnerable systems that are connected to the internet.

“This group is very active and good at finding vulnerable systems. They have successfully attacked healthcare, education, professional services, and finance organizations in Australia, the U.K., and the U.S.,” stated the Microsoft Threat Intelligence team in their report.

Attacks carried out by Storm-1175 have used zero-day exploits, even before they were publicly known, as well as recently revealed vulnerabilities to gain initial access. In some cases, the group has combined multiple exploits (like OWASSRF) to carry out further malicious activities after gaining access.

Once inside a system, the financially driven attackers quickly steal data and deploy Medusa ransomware within a few days, and sometimes even within 24 hours.

To help them succeed, the group creates new user accounts to maintain access, uses web shells or legitimate remote monitoring and management (RMM) software for lateral movement, steals credentials, and disrupts security tools before installing the ransomware.

Since 2023, Storm-1175 has been linked to exploiting over 16 vulnerabilities:

• CVE-2023-21529 (Microsoft Exchange Server)
• CVE-2023-27351 and CVE-2023-27350 (Papercut)
• CVE-2023-46805 and CVE-2024-21887 (Ivanti Connect Secure and Policy Secure)
• CVE-2024-1708 and CVE-2024-1709 (ConnectWise ScreenConnect)
• CVE-2024-27198 and CVE-2024-27199 (JetBrains TeamCity)
• CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 (SimpleHelp)
• CVE‑2025‑31161 (CrushFTP)
• CVE-2025-10035 (Fortra GoAnywhere MFT)
• CVE-2025-52691 and CVE-2026-23760 (SmarterTools SmarterMail)
• CVE-2026-1731 (BeyondTrust)

Both CVE-2025-10035 and CVE-2026-23760 were reportedly exploited as zero-days before they were publicly disclosed. In late 2024, the group showed a preference for targeting Linux systems, including exploiting vulnerable Oracle WebLogic instances in several organizations, although the specific vulnerability used remains unknown.

“Storm-1175 quickly switches between exploits during the period between when a vulnerability is disclosed and when a patch is available or implemented, taking advantage of the fact that many organizations are still vulnerable,” Microsoft stated.

Some of the key methods observed in these attacks include:

• Using existing system tools (LOLBins) like PowerShell and PsExec, along with Impacket for moving around the network.
• Using PDQ Deployer for both moving around the network and delivering payloads, like Medusa ransomware.
• Changing Windows Firewall settings to allow Remote Desktop Protocol (RDP) and deliver malicious payloads to other devices.
• Stealing credentials using Impacket and Mimikatz.
• Setting up Microsoft Defender Antivirus exclusions to prevent it from blocking ransomware.
• Using Bandizip and Rclone for collecting and stealing data.

A significant concern is that RMM tools like AnyDesk, Atera, MeshAgent, ConnectWise ScreenConnect, and SimpleHelp are being used for malicious purposes, as they allow attackers to hide malicious activity within trusted, encrypted platforms, making it harder to detect.