Storm-1175 - High-Tempo Medusa Ransomware Operations Unveiled

What Happened

Storm-1175, a financially motivated cybercriminal group, has been conducting high-velocity ransomware campaigns that exploit recently disclosed vulnerabilities. Their operations focus on vulnerable web-facing assets, allowing them to gain initial access, exfiltrate data, and deploy Medusa ransomware in record time.

How It Works

The group takes advantage of N-day vulnerabilities, which are flaws disclosed but not yet patched by organizations. Storm-1175 has been observed exploiting over 16 vulnerabilities since 2023, including notable ones like CVE-2023-21529 (Microsoft Exchange) and CVE-2025-10035 (GoAnywhere MFT). They can move from initial access to data exfiltration and ransomware deployment in as little as 24 hours.

Who's Being Targeted

Recent attacks have heavily impacted sectors such as healthcare, finance, and education across regions including the United States, United Kingdom, and Australia. The rapid pace of their operations has made them a significant threat to organizations that fail to adopt timely patches.

Signs of Infection

Indicators of a Storm-1175 attack may include:

• Unusual account creations or modifications in user privileges.
• Unexpected changes in antivirus settings or exclusions.
• Rapid deployment of remote monitoring tools or unauthorized software.

How to Protect Yourself

Organizations can mitigate the risks associated with Storm-1175 by:

• Regularly updating and patching systems to close vulnerabilities.
• Monitoring for unusual account activity and credential theft.
• Implementing strong access controls and limiting local administrative privileges.
• Utilizing tools like Microsoft Defender for Endpoint to detect lateral movement and unauthorized access attempts.

Technical Details

Storm-1175 has demonstrated a capability to quickly rotate exploits, often leveraging zero-day vulnerabilities. They have also been seen chaining multiple exploits to enhance their post-compromise activities. For instance, they exploited vulnerabilities in Microsoft Exchange to gain initial access, followed by executing remote code to deepen their foothold.

Defensive Measures

To defend against such rapid and sophisticated attacks, organizations should:

• Conduct regular security assessments and vulnerability scans.
• Educate staff on recognizing phishing attempts and suspicious activity.
• Implement a robust incident response plan to quickly address potential breaches.

Understanding the tactics employed by Storm-1175 is crucial for organizations to bolster their defenses against ransomware and similar cyber threats.