Storm-1175: The Chinese Group Deploying Medusa Ransomware via Zero-Days in Under 24 Hours

On April 6, 2026, Microsoft published a detailed analysis of Storm-1175, a financially motivated Chinese threat actor orchestrating "high-velocity" attacks using a combination of zero-day and N-day vulnerabilities to deploy Medusa ransomware. The most alarming data point: in select incidents, Storm-1175 moves from initial compromise to data exfiltration and ransomware deployment in under 24 hours. This operational tempo leaves victims virtually no response window.

Zero-Days Exploited Before Disclosure: SmarterMail and GoAnywhere

Storm-1175 recently exploited two critical vulnerabilities as zero-days: CVE-2026-23760 in SmarterMail and CVE-2025-10035 in GoAnywhere Managed File Transfer. Both were exploited a full week before public disclosure. In recent campaigns, the group has exploited more than 16 vulnerabilities across 10 software products including Microsoft Exchange, PaperCut, Ivanti Connect Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, and BeyondTrust.

Attack Anatomy: From Compromise to Ransomware in 24 Hours

Microsoft reconstructed Storm-1175's attack chain in distinct phases. Initial exploitation targets web-facing assets with high operational tempo. From a compromised SmarterMail application, the actor modifies the firewall and enables Remote Desktop for lateral movement. For persistence, the group creates new user accounts, deploys web shells, and installs legitimate RMM software. For credential theft and lateral movement, Storm-1175 uses Impacket and PDQ Deployer. Data exfiltration uses Bandizip for compression and Rclone for transfer to attacker-controlled cloud storage.

A particularly sophisticated evasion technique: Storm-1175 uses encoded PowerShell commands to add the entire C:\ drive to the antivirus exclusion path. This single command effectively disables all endpoint protection, preventing the security solution from scanning any file on disk.

Double Extortion: Exfiltrate First, Encrypt Second

Medusa operates a double-extortion model: before ransomware activation, all sensitive data is exfiltrated to attacker-controlled servers. The FBI and CISA documented that Medusa has successfully breached over 300 organizations in critical infrastructure by February 2025. The most impacted sectors in Storm-1175's recent campaigns are healthcare, education, professional services, and finance in Australia, the United Kingdom, and the United States — but the global nature of the vulnerabilities means European organizations are equally exposed.

The China Nexus: Crime or State?

Microsoft classifies Storm-1175 as "financially motivated" and China-based. But the boundary between cybercrime and state operations in the Chinese landscape is notoriously blurred. The fact that a Chinese group exploits zero-days — capabilities typically associated with state resources — for ransomware operations raises questions about the operation's true nature. The combination of zero-day exploitation, extreme operational speed, and critical sector targeting suggests an actor with significant resources and possible institutional support.

Exploited Vulnerabilities: Storm-1175's Arsenal

• CVE-2026-23760 — SmarterMail: authentication bypass (zero-day)
• CVE-2025-10035 — GoAnywhere MFT: unauthorized access (zero-day)
• Microsoft Exchange — OWASSRF chain and related vulnerabilities
• PaperCut — critical print management vulnerabilities
• Ivanti Connect Secure — enterprise VPN authentication bypass
• ConnectWise ScreenConnect — remote code execution
• JetBrains TeamCity — CI/CD pipeline compromise
• SimpleHelp — remote support software exploitation
• CrushFTP — file transfer server vulnerabilities
• BeyondTrust — PAM privilege escalation

Observed Tools and TTPs

• LOLBins: PowerShell and PsExec for lateral movement and command execution
• Impacket: toolkit for Windows protocol interaction (SMB, WMI, DCE/RPC)
• PDQ Deployer: abused for lateral payload and ransomware deployment
• Rclone: data exfiltration to attacker-controlled cloud storage
• Bandizip: data compression before exfiltration
• Web shells: persistence on compromised web servers
• Legitimate RMM software: persistence and command & control
• Encoded PowerShell: antivirus exclusion addition to disable protection

Operational Recommendations

1. 1.Priority patching of target products: immediately update SmarterMail, GoAnywhere MFT, Microsoft Exchange, PaperCut, Ivanti Connect Secure, ConnectWise, JetBrains TeamCity, SimpleHelp, CrushFTP, and BeyondTrust.
2. 2.Antivirus exclusion monitoring: implement automatic alerts for any modification to Microsoft Defender or other AV/EDR exclusions. Adding the entire C:\ drive to exclusions is a critical indicator of active compromise.
3. 3.Block Rclone and exfiltration tools: Rclone has no legitimate use in most enterprise environments. Block its execution via AppLocker or equivalent EDR policies.
4. 4.PDQ Deployer monitoring: if not legitimately used, block its execution. If in use, monitor anomalous deployments outside business hours or to unexpected systems.
5. 5.Web-facing asset hardening: minimize internet-exposed attack surface. Every web-facing application must be behind a WAF with limited access and constant updates.
6. 6.Network segmentation: limit lateral movement with rigorous segmentation. Ransomware deployment via PDQ Deployer across the entire network requires flat connectivity — segmentation prevents this.
7. 7.Offline and tested backups: double extortion makes backups necessary but insufficient. Ensure backups are air-gapped, encrypted, and regularly tested for restoration.
8. 8.Sub-24-hour ransomware incident response plan: given Storm-1175's speed, incident response plans must enable containment in hours, not days.

Conclusion: The New Speed of Ransomware

Storm-1175 represents the most dangerous evolution of modern ransomware: an actor with zero-day access, extreme operational speed, and the ability to move from initial compromise to ransomware deployment in under 24 hours. For European organizations, the message is clear: patching can no longer wait for the next scheduled maintenance window. The gap between "vulnerability published" and "network compromised" has shrunk to zero.