Storm-1175 Exploits Web Vulnerabilities in Medusa Ransomware Attacks

Storm-1175 Exploits Web Vulnerabilities in Medusa Ransomware Attacks

In early April 2026, Microsoft Security Intelligence reported a surge in ransomware attacks orchestrated by the threat actor group known as Storm-1175. These attacks have been characterized by the exploitation of vulnerable web-facing assets, leading to rapid deployment of the Medusa ransomware. Organizations with unpatched or misconfigured web applications are particularly at risk.

Rapid Attack Progression

Storm-1175 has demonstrated the capability to progress from initial access to full ransomware deployment in as little as one day. In many instances, the entire attack chain unfolds over a period of five to six days. This swift progression underscores the importance of timely detection and response to such threats.

Exploitation Techniques

The group's modus operandi involves targeting web-facing assets with known vulnerabilities. Upon successful exploitation, they establish a foothold by deploying web shells or remote access payloads. Persistence is often achieved by creating new user accounts with administrative privileges, facilitating further reconnaissance and lateral movement within the compromised network.

Tools and Tactics

Storm-1175 employs a variety of tools to maintain access and escalate their attacks:

• Remote Monitoring and Management (RMM) Tools: Legitimate software such as ConnectWise ScreenConnect, AnyDesk, and SimpleHelp are repurposed to maintain persistence, create new user accounts, and deliver additional payloads.
• PDQ Deploy: This legitimate software deployment tool is utilized for lateral movement and the distribution of ransomware across the network.
• Impacket: An open-source collection of Python classes for working with network protocols, Impacket is leveraged for lateral movement. Microsoft Defender for Endpoint offers an attack surface reduction rule to mitigate such techniques.

Mitigation Strategies

Organizations are advised to implement the following measures to defend against such attacks:

• Patch Management: Regularly update and patch all web-facing assets to address known vulnerabilities.
• Access Controls: Monitor and restrict the use of RMM tools to prevent unauthorized access.
• Network Segmentation: Implement segmentation to limit lateral movement within the network.
• Endpoint Detection and Response (EDR): Deploy EDR solutions to detect and respond to suspicious activities promptly.

By proactively addressing these areas, organizations can enhance their resilience against ransomware campaigns like those executed by Storm-1175.

For more detailed information, refer to the original report by Microsoft Security Intelligence: Microsoft Security Blog