{"id":517,"date":"2026-04-07T08:19:09","date_gmt":"2026-04-07T08:19:09","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=517"},"modified":"2026-04-07T08:19:09","modified_gmt":"2026-04-07T08:19:09","slug":"china-linked-storm-1175-exploits-zero-days-to-rapidly-deploy-medusa-ransomware","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=517","title":{"rendered":"China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 07, 2026<\/span><\/span>Vulnerability \/ Threat Intelligence<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A\u00a0China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate \u00abhigh-velocity\u00bb attacks and break into susceptible internet-facing\u00a0systems.<\/p>\n

\u00abThe threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia,\u00a0the United Kingdom, and the United States,\u00bb the Microsoft Threat Intelligence\u00a0team said<\/a>.<\/p>\n

Attacks mounted\u00a0by Storm-1175<\/strong> have also leveraged zero-day exploits, in some cases, before they have been publicly disclosed, as well as recently disclosed vulnerabilities to obtain initial access. Select\u00a0incidents have involved the threat actor chaining together multiple exploits\u00a0(e.g., OWASSRF) for post-compromise\u00a0activity.<\/p>\n

Upon\u00a0gaining a foothold, the financially motivated cybercriminal actor swiftly moves to exfiltrate data and deploy Medusa ransomware within a span of a few days, or, in select incidents, within 24\u00a0hours.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

To\u00a0aid in these efforts, the group creates persistence by creating new user accounts, deploying web shells or legitimate remote monitoring and management (RMM) software for lateral movement, conducting credential theft, and interfering with the normal functioning of security solutions, before dropping the ransomware.<\/p>\n

Since\u00a02023, Storm-1175 has been linked to the exploitation of more than 16 vulnerabilities\u00a0–<\/p>\n

\"\"<\/a><\/div>\n

Both\u00a0CVE-2025-10035\u00a0and CVE-2026-23760\u00a0are said to have been exploited\u00a0as zero-days prior\u00a0to them being publicly\u00a0disclosed.As\u00a0of late 2024, the hacking crew\u00a0has exhibited\u00a0a flair for targeting Linux systems,\u00a0including exploiting vulnerable Oracle WebLogic instances\u00a0across several organizations. However, the exact vulnerability that\u00a0was being weaponized in these attacks remains\u00a0unknown.<\/p>\n

\u00abStorm-1175 rotates exploits quickly during the time between disclosure and patch availability or adoption, taking advantage of the period where many organizations remain unprotected,\u00bb Microsoft\u00a0said.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Some\u00a0of the notable tactics observed in these attacks are as follows\u00a0–<\/p>\n

    \n
  • Using living-off-the-land binaries (LOLBins), including PowerShell and PsExec, along with Impacket for lateral movement.<\/li>\n
  • Relying on PDQ Deployer for both lateral movement and payload delivery, including Medusa ransomware, across the network.<\/li>\n
  • Modifying Windows Firewall policies to enable Remote Desktop Protocol (RDP) and deliver malicious payloads to other devices.<\/li>\n
  • Carrying out credential dumping using Impacket and Mimikatz.<\/li>\n
  • Configuring Microsoft Defender Antivirus exclusions to prevent it from blocking ransomware payloads.<\/li>\n
  • Leveraging Bandizip and Rclone for data collection and exfiltration, respectively.<\/li>\n<\/ul>\n

    The\u00a0bigger implication here is that RMM tools like AnyDesk, Atera, MeshAgent, ConnectWise ScreenConnect, or SimpleHelp are becoming dual-use infrastructure for covert operations, as they allow threat actors to blend malicious traffic into trusted, encrypted platforms and reduce the likelihood of detection.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \ue804Ravie Lakshmanan\ue802Apr 07, 2026Vulnerability \/ Threat Intelligence A\u00a0China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to…<\/p>\n","protected":false},"author":1,"featured_media":518,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[479,229,430,92,93,1098,1097,53],"class_list":["post-517","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-chinalinked","tag-deploy","tag-exploits","tag-medusa","tag-ransomware","tag-rapidly","tag-storm1175","tag-zerodays"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/517","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=517"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/517\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/518"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=517"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=517"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=517"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}