According to Microsoft, Storm-1175, a Chinese financially motivated cybercriminal group known for using Medusa ransomware, is rapidly exploiting both known (n-day) and previously unknown (zero-day) vulnerabilities in their attacks.

This group quickly adapts to using new security flaws to infiltrate victim networks, sometimes deploying exploits within a day of discovery or even before a patch is available.

“Storm-1175 is very quick at moving from gaining initial access to stealing data and deploying Medusa ransomware, often within days or even just a day,” Microsoft explained.

“The attacker’s speed and skill in finding vulnerable systems on the network perimeter have been effective, with recent breaches significantly affecting healthcare, education, professional services, and finance organizations in Australia, the UK, and the USA.”

Microsoft also noted that Storm-1175 combines multiple exploits to maintain access to compromised systems by creating new accounts, installing remote management software, stealing login credentials, and disabling security measures before deploying ransomware.

In October, Microsoft reported that Storm-1175 was exploiting a critical vulnerability in GoAnywhere MFT (CVE-2025-10035) in Medusa ransomware attacks for more than a week before a fix was released.

Another zero-day vulnerability targeted by Storm-1175 was CVE-2026-23760, an authentication bypass issue found in SmarterTools’ SmarterMail, an email and collaboration server.

“While these recent attacks suggest Storm-1175 has improved their capabilities or gained access to exploit resources, it’s important that GoAnywhere MFT has been a target for ransomware groups before and that the discovered SmarterMail vulnerability was reportedly similar to a known vulnerability,” Microsoft said.

“These factors likely contributed to Storm-1175’s zero-day exploitation, although they primarily use known (N-day) vulnerabilities.”

​In recent attacks, Storm-1175 has exploited over 16 vulnerabilities across 10 software products, including Microsoft Exchange (CVE-2023-21529), Papercut (CVE-2023-27351 and CVE-2023-27350), Ivanti Connect Secure and Policy Secure (CVE-2023-46805 and CVE-2024-21887), and ConnectWise ScreenConnect (CVE-2024-1709 and CVE-2024-1708).

Microsoft has also observed them exploiting vulnerabilities in JetBrains TeamCity (CVE-2024-27198 and CVE-2024-27199), SimpleHelp (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728), CrushFTP (CVE‑2025‑31161), SmarterMail (CVE-2025-52691), and BeyondTrust (CVE-2026-1731).

In March 2025, CISA, along with the FBI and MS-ISAC, issued an alert stating that the Medusa ransomware group had targeted over 300 critical infrastructure entities across the United States.

In July 2024, Microsoft also associated Storm-1175, along with three other groups, to Black Basta and Akira ransomware attacks that exploited a VMware ESXi authentication bypass vulnerability.