Essential Insights
- Storm-1175 is executing rapid, high-velocity ransomware campaigns, often within 24 hours of vulnerability disclosure, targeting known and zero-day flaws.
- The group heavily exploits vulnerabilities in industries like healthcare and finance across Australia, UK, and US, leveraging vulnerabilities such as CVE-2026-1731 and others in popular software.
- They demonstrate advanced tactics, including tampering with security tools like Microsoft Defender, and using tools like RMM, Impacket, and Rclone for lateral movement and data exfiltration.
- Microsoft urges organizations to prioritize immediate patching, enable tamper protections, and isolate web-facing systems to mitigate the threat from Storm-1175’s swift and sophisticated attacks.
Storm-1175 Accelerates Medusa Ransomware Attacks at ‘High Velocity’
Recently, a cybercrime group known as Storm-1175 has been running rapid campaigns to deploy Medusa ransomware. These attacks are happening faster than many organizations can respond. The group is actively exploiting known vulnerabilities in systems. This tactic pressures organizations to patch their critical software quickly. Microsoft’s threat analysts have described how Storm-1175’s speed enables it to move from exploiting vulnerabilities to locking files in just a few days or even within 24 hours. As a result, sectors like health care, finance, and education face significant threats across Australia, the U.K., and the U.S. due to this high operational tempo.
Exploiting Known and Zero-Day Vulnerabilities for Rapid Attacks
Storm-1175 focuses on exploiting both known flaws, called N-days, and new, unpatched vulnerabilities known as zero-days. Recently, they exploited CVE-2026-1731, a critical flaw in BeyondTrust Remote Support. They also targeted CVE-2025-31161 in CrushFTP, and CVE-2024-27198 in JetBrains’ TeamCity. Additionally, they exploited a Microsoft Exchange flaw, CVE-2023-21529, in early 2023. The group further weaponized recent zero-days like CVE-2026-23760 in SmarterMail and CVE-2025-10035 in GoAnywhere’s MFT software. These attacks highlight how quickly threat actors can respond to newly discovered vulnerabilities. They also show how attackers use sophisticated techniques such as tampering with security programs and using remote monitoring tools to move laterally through networks and exfiltrate data. As attackers adapt, organizations must prioritize immediate patching and robust security practices to defend their systems.
Discover More Technology Insights
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Access comprehensive resources on technology by visiting Wikipedia.
CyberRisk-V1
