Storm-1175 Hackers Exploit N-Day Vulnerabilities at Record Speed, Deploying Medusa Ransomware Globally A cybercriminal group tracked by Microsoft Threat Intelligence as Storm-1175 is wreaking havoc worldwide by rapidly exploiting unpatched vulnerabilities to deploy Medusa ransomware. Specializing in targeting perimeter assets systems directly exposed to the internet the group capitalizes on the critical window between a security flaw’s disclosure and an organization’s patch deployment. ### Blitzkrieg Tactics: Exploits in Under 24 Hours Storm-1175 operates with alarming efficiency, often compromising networks within hours of a vulnerability’s public disclosure. In one recent attack, the group exploited CVE-2025-31324, a flaw in SAP NetWeaver, just one day after its April 24, 2025, announcement. The campaign has disrupted schools, law firms, and hospitals across the UK, US, and Australia. Since 2023, the group has weaponized over 16 vulnerabilities, including high-profile flaws in PaperCut (CVE-2023-27351) and JetBrains TeamCity (CVE-2024-27198). Notably, Storm-1175 has also demonstrated zero-day exploitation, as seen in its early 2026 attack on SmarterMail (CVE-2026-23760), where it struck a full week before the vulnerability was publicly known. ### Stealthy Lateral Movement & Defense Evasion Once inside a network, Storm-1175 leverages legitimate remote management tools like AnyDesk, ConnectWise ScreenConnect, and PDQ Deployer to move undetected. The group uses Rclone and Bandizip to exfiltrate data before deploying ransomware across entire systems. A key tactic involves disabling security defenses by manipulating antivirus exclusions adding the C:\ drive to an exclusion path to prevent detection. This allows the ransomware to execute unimpeded, crippling critical infrastructure. ### A New Era of Cyber Threats Security experts warn that Storm-1175’s speed and precision mark a dangerous evolution in cybercrime. Unlike opportunistic groups like MedusaLocker, which rely on brute-force attacks, Storm-1175 employs a deliberate, multi-stage playbook, chaining exploits and abusing trusted tools to maximize damage. The group’s ability to operationalize vulnerabilities within hours sometimes before patches are available highlights a growing gap between attacker agility and traditional security defenses. Organizations with slow patching cycles or static security assessments are particularly vulnerable to these high-speed, high-impact attacks.