{"id":45187,"date":"2026-04-07T22:49:11","date_gmt":"2026-04-07T14:49:11","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/07\/china-linked-storm-1175-exploits-zero-days-to-rapidly-deploy-medusa-ransomware\/"},"modified":"2026-04-07T22:49:11","modified_gmt":"2026-04-07T14:49:11","slug":"china-linked-storm-1175-exploits-zero-days-to-rapidly-deploy-medusa-ransomware","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/07\/china-linked-storm-1175-exploits-zero-days-to-rapidly-deploy-medusa-ransomware\/","title":{"rendered":"China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware"},"content":{"rendered":"
\"China-Linked<\/a><\/div>\n

A China-based threat actor known for deploying Medusa ransomware has been linked to the weaponization of a combination of zero-day and N-day vulnerabilities to orchestrate “high-velocity” attacks and break into susceptible internet-facing systems.<\/p>\n

“The threat actor’s high operational tempo and proficiency in identifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States,” the Microsoft Threat Intelligence team said<\/a>.<\/p>\n

Attacks mounted by Storm-1175<\/a><\/strong> have also leveraged zero-day exploits, in some cases, before they have been publicly disclosed, as well as recently disclosed vulnerabilities to obtain initial access. Select incidents have involved the threat actor chaining together multiple exploits (e.g., OWASSRF<\/a>) for post-compromise activity.<\/p>\n

Upon gaining a foothold, the financially motivated cybercriminal actor swiftly moves to exfiltrate data and deploy Medusa ransomware within a span of a few days, or, in select incidents, within 24 hours.<\/p>\n

To aid in these efforts, the group creates persistence by creating new user accounts, deploying web shells or legitimate remote monitoring and management (RMM) software for lateral movement, conducting credential theft, and interfering with the normal functioning of security solutions, before dropping the ransomware.<\/p>\n

Since 2023, Storm-1175 has been linked to the exploitation of more than 16 vulnerabilities –<\/p>\n