CyberSecurity

Storm-1175: How a High-Tempo Cybercrime Group Exploits the Patch Gap

Published

3 months ago

April 21, 2026

Storm-1175: How a High-Tempo Cybercrime Group Exploits the Patch Gap

A financially motivated cybercrime group, identified as Storm-1175, has been conducting a relentless campaign of Medusa ransomware attacks for three years. According to a recent Microsoft report, the group’s success hinges on a simple, brutal strategy: exploiting the critical window between when a software vulnerability is disclosed and when organizations manage to patch it. This focus on the patch gap has made the Storm-1175 ransomware operation particularly damaging.

Building on this, the group’s operational speed is a key differentiator. Microsoft notes that Storm-1175 can move from initial network access to full ransomware deployment in as little as one day, though the process sometimes takes up to six. This high tempo, combined with skill in finding exposed assets, has led to significant intrusions. Consequently, sectors like healthcare, education, professional services, and finance in Australia, the UK, and the US have borne the brunt of the attacks.

The Exploit Arsenal of Storm-1175

Since 2023, the group has weaponized at least 16 different vulnerabilities. Alarmingly, this includes three zero-day flaws—vulnerabilities exploited before the vendor is even aware or has issued a fix. A prime example is CVE-2025-10035, a flaw in GoAnywhere Managed File Transfer software, which Storm-1175 exploited a full week before it was publicly disclosed. This pattern underscores their proactive threat-hunting capabilities.

In addition to zero-days, the group heavily relies on n-day exploits—those targeting recently disclosed but still unpatched vulnerabilities. Their target list reads like a who’s who of enterprise software, including Ivanti Connect Secure, ConnectWise ScreenConnect, JetBrains TeamCity, and BeyondTrust. Therefore, any delay in applying security updates creates an immediate and exploitable opportunity for this actor.

Inside the Attack Chain: From Access to Encryption

Understanding their methods is crucial for defense. After breaching a network, often through an unpatched public-facing application, Storm-1175 follows a calculated playbook. First, they establish an initial foothold by deploying a web shell or a remote access payload. Immediately after, they work to ensure persistence, typically by creating a new user account and adding it to the local administrators group.

Lateral Movement and Evasion Tactics

With a secure beachhead established, the group begins reconnaissance and lateral movement. They adeptly use living-off-the-land binaries (LOLBins) like PowerShell and PsExec, which are native to Windows environments and harder to detect. To move between systems, they often deploy Cloudflare tunnels to channel traffic over Remote Desktop Protocol (RDP).

Furthermore, they employ multiple Remote Monitoring and Management (RMM) tools for post-compromise activities. These legitimate tools are repurposed to create accounts, establish backup command-and-control channels, and deliver final payloads. In some cases, they even use the software deployment tool PDQ Deployer to silently install malicious applications across the network. To avoid detection, they have been known to modify Microsoft Defender Antivirus settings in the Windows registry to prevent it from blocking their ransomware payload.

How Organizations Can Mitigate the Threat

Given the sophisticated and rapid nature of these Storm-1175 ransomware attacks, a proactive and layered defense is non-negotiable. Microsoft’s guidance starts with fundamental visibility. Organizations must use perimeter scanning tools to fully understand their external attack surface. Any web-facing system should be isolated from the public internet behind a secure network boundary and accessed strictly through a VPN.

For systems that must remain connected, placing them behind a Web Application Firewall (WAF), reverse proxy, or a demilitarized zone (DMZ) is essential. This creates an additional buffer that can filter malicious traffic before it reaches the core asset.

Critical Security Hardening Recommendations

On the internal network, several specific actions can drastically reduce risk. First, adhere to strict credential hygiene principles and implement measures to limit lateral movement, as outlined in general ransomware defense guidance. Enabling Credential Guard helps protect sensitive credentials stored in system memory from being harvested by tools like Impacket, which Storm-1175 sometimes uses.

Another vital step is to turn on tamper protection in your endpoint security solutions. This prevents attackers from disabling security services or creating antivirus exclusions, a tactic this group employs. Additionally, audit and remove any unapproved RMM software installations. For approved RMM tools, enforce multi-factor authentication (MFA) to block unauthorized access.

Finally, ensure your extended detection and response (XDR) tools are configured to recognize and block the common techniques seen in these attacks. By understanding the tools and TTPs of groups like Storm-1175, security teams can create more effective detection rules. The race between patching and exploitation defines modern cyber defense, and against a determined adversary like Storm-1175, speed and vigilance are everything.

CyberSecurity

Attackers weaponize dormant GitHub accounts to map corporate networks undetected

Published

10 hours ago

July 23, 2026

Social Media Admin

The quiet threat of ‘ghost’ accounts

When a GitHub account sits untouched for years, most teams assume it’s harmless. A forgotten developer profile, an old bot, a test user — nothing to worry about, right?

Wrong. According to Datadog Security Labs, attackers are actively weaponizing these dormant accounts. They call them ‘ghost’ accounts, and they’re a core part of a broader campaign to map out corporate GitHub organizations, repositories, and user accounts without raising alarms.

The technique is deceptively simple: automated scripts scrape the GitHub API using custom user agents that sound legitimate. The accounts themselves are often years old — meaning they pass basic age checks and don’t trigger the suspicion a fresh profile would.

How the enumeration works

Datadog’s report details several overlapping campaigns, all targeting the same thing: organizational structure. Attackers aren’t after code — at least not yet. They want the map.

By making API calls to list members of an organization, pull repository metadata, and check user profiles, they can build a detailed picture of who works where, what projects exist, and which accounts have elevated access. That reconnaissance is gold for a follow-up phishing attack or a credential-stuffing attempt.

OAuth tokens in the mix

It gets worse. Some of these campaigns don’t rely on ghost accounts at all. Instead, they use compromised OAuth tokens — keys that were either stolen or leaked — to authenticate as a legitimate user. Once inside, the attacker can scrape even more data because the API trusts the token.

This is a classic GitHub API abuse scenario: the API itself is working as designed. The problem is that the credentials behind the requests are not what they seem.

Why old accounts fly under the radar

Security teams often focus on new accounts and unusual login locations. A dormant GitHub account that suddenly starts making API calls? That’s harder to catch. The account already exists. It might have a history of commits, comments, or issues. The behavior shift is subtle.

Add in custom user agents that mimic popular tools like curl or official GitHub CLI clients, and you have a recipe for invisibility. The traffic looks normal. The account looks normal. Only the intent is malicious.

What organizations should do

There’s no single fix, but Datadog points to a few concrete steps that reduce the risk significantly:

Audit OAuth tokens regularly. Revoke any token that hasn’t been used in 90 days. Attackers love old, forgotten tokens.
Monitor API call patterns. A sudden spike in member enumeration or repository listing from a single account — especially an old one — is worth investigating.
Enforce two-factor authentication (2FA). It won’t stop a compromised token, but it makes ghost account takeovers much harder.
Review organization membership. Remove users who no longer work on the project. Every extra account is a potential entry point.

For more on securing your development pipeline, check out our guide on GitHub security best practices and how to handle compromised API tokens.

The bottom line

Attackers are getting smarter about blending in. They’re not smashing the front door — they’re using keys that were left under the mat years ago. Dormant GitHub accounts, old tokens, and legitimate-looking traffic are the new normal in corporate reconnaissance.

The takeaway? Clean up your digital attic. Every old account and every unused token is a liability. And in this case, the ghosts are very real.

CyberSecurity

The Summer of Clearinghouses: Why One Platform Was Already Live When Everyone Else Was Just Talking

Published

14 hours ago

July 23, 2026

Social Media Admin

Suddenly, Everyone Has a Clearinghouse

The past few weeks have felt like a parade of press releases. Company after company has stepped up to announce its own clearinghouse — a new platform, a new promise, a new way to handle data or transactions. It’s a crowded field, and the announcements keep piling up.

Our team joined the chorus, too. We announced Athena. But there’s a catch: when we told the world about it, the product wasn’t a PowerPoint slide or a beta waiting list. It was already live. Real customers were using it. Fixes were being shipped. The code had been running quietly for months.

Why the Rush to Announce?

It’s tempting to ask: why now? Why did so many clearinghouses suddenly emerge in the same window? Part of the answer is market timing. The industry has reached a point where a clearinghouse isn’t a nice-to-have; it’s becoming table stakes. Companies that don’t have one risk looking like they’re falling behind.

But there’s another layer. Announcing early can signal ambition to investors, partners, and customers. It builds buzz. It creates a narrative. The problem? Many of these announcements are vapor — promises without a product behind them. They’re built on roadmaps, not running code.

Athena: Built in Silence, Shipped in Secret

That’s where Athena broke the mold. The team behind it didn’t start building when the trend emerged. They started because customers kept asking for a solution — a real one, not a concept. So they built it. Quietly. No press releases, no teaser campaigns.

They took findings from early users and turned them into fixes. They iterated. They made mistakes, corrected them, and kept shipping. The product grew organically, shaped by actual demand rather than a product manager’s whiteboard.

“We only announced it now because everyone else started announcing theirs,” one team member said. The implication is clear: Athena was never about the announcement. It was about the work.

What Sets a Live Platform Apart

There’s a fundamental difference between a clearinghouse that’s been running for months and one that’s still in development. A live platform has battle scars. It has handled edge cases. It has real data flowing through it, which means real insights about what works and what doesn’t.

For customers, that difference matters. A live platform means:

Immediate value — no waiting for a launch date.
Proven reliability — bugs have been found and fixed.
Real feedback loops — the product evolves based on usage, not assumptions.

In a summer of clearinghouse announcements, Athena stands out because it was already doing the job while others were still drafting their blog posts.

The Noise vs. The Signal

So what should customers and industry watchers take away from this wave of announcements? First, it’s worth asking: is the product real? Can you use it today? Does it have a track record, even a short one?

Second, look for specificity. Vague claims about “revolutionizing” or “transforming” something are easy to make. Concrete numbers — users onboarded, transactions processed, bugs squashed — are harder to fake. Athena had those numbers before the first press release went out.

Finally, remember that a clearinghouse is only as good as the work behind it. The hype cycle will pass. What remains are the platforms that actually solve problems. In this summer of clearinghouses, one was already solving them — quietly, steadily, and without fanfare — long before the announcements started.

CyberSecurity

LG to Ban Residential Proxies from Smart TV Apps After Security Study

Published

1 day ago

July 22, 2026

Social Media Admin

Why LG Is Cracking Down on Proxy SDKs

LG Electronics announced this week it will suspend any smart TV apps that turn televisions into always-on residential proxy nodes. The move comes less than a month after researchers revealed that over 42 percent of games and utilities on LG’s webOS store let unknown third parties route internet traffic through users’ TVs.

Security firm Spur published findings in early July showing that residential proxy software development kits (SDKs) have quietly infiltrated smart TV platforms. For Samsung’s Tizen OS, more than a quarter of apps contained similar components. The data suggests a systemic problem, not an isolated incident.

What Are Residential Proxies Doing in Your TV?

Residential proxy networks pay app developers to embed SDKs that turn a device into a proxy node. Paying customers then rent that node to route their own traffic through it. In LG and Samsung smart TVs, Spur found these SDKs bundled with everything from Pac-Man clones to screensavers and file managers.

A Pac-Man app from Bright Data even offers users a choice: watch ads or let the TV serve as a proxy node. Bright Data, which accounted for the majority of proxy SDKs on both platforms, did not respond to requests for comment.

Bright Data and other providers claim they follow rigorous know-your-customer processes to prevent abuse. They also say they deploy countermeasures that stop proxy customers from interacting with other devices on the user’s local network. But critics argue that a one-time consent prompt buried in a TV app is not enough.

LG’s Response: Suspensions and Policy Changes

LG Senior Vice President John Taylor told KrebsOnSecurity that the company is working with developers to remove residential proxy options from their apps. Developers that fail to comply will see their apps suspended.

“A residential proxy network is not an intended use for LG smart TVs,” Taylor said. “LG Electronics is working with developers to remove the residential proxy option from their apps on the webOS platform. If this option is not removed, these apps will be suspended.”

Taylor added that the review is “well underway now.” LG will also strengthen its evaluation process for developer-submitted apps, including those that incorporate proxy SDKs.

The Deeper Problem: Consent and Awareness

Spur’s Trevor Sutter put it bluntly: “A one-time consent prompt buried in a TV app is not a substitute for meaningful transparency, ongoing control, and platform oversight. The risk is amplified when consent comes from individuals within the household who use the device but shouldn’t give consent, such as minors.”

Most consumers do not think of their smart TV as a computer. They don’t audit apps or check for background network activity. That makes residential proxies particularly insidious. The device sits in the living room, always on, always connected — an ideal node for someone who wants to hide their traffic behind a real residential IP address.

Spur’s report notes that the problem is not that residential proxy networks exist, but that they are being embedded at scale in devices that most people cannot easily monitor.

LG’s Other Controversy: McAfee Bloatware

LG’s announcement comes amid criticism over another partnership. This week, the YouTube channel Gamers Nexus showed that certain LG LCD monitors automatically install an app promoting paid McAfee antivirus subscriptions. The app arrives through Windows Update without any approval prompt. Users reported that the software drivers push McAfee promotions without consent, triggering frustration among gamers and professionals alike.

LG has not yet commented on the McAfee issue. But the combination of proxy SDKs in smart TVs and unwanted antivirus promotions in monitors suggests a pattern: LG is comfortable embedding third-party monetization in its hardware, often without clear user consent.

What This Means for LG Users

For now, LG’s crackdown on residential proxies is a positive step. Users should check which apps are installed on their webOS smart TVs and remove any they do not recognize. If an app offers a choice between ads and “network sharing,” the safest option is to uninstall it entirely.

The company says it will continue to review apps and enforce the ban. Whether that translates into real change — or just a temporary PR move — remains to be seen. But for the millions of LG smart TV owners, the message is clear: your television should not be a tool for strangers to hide their internet activity.

As Spur’s research showed, the problem extends beyond LG. Samsung has not announced any similar action for its Tizen platform. Consumers who want to avoid residential proxies altogether may need to look beyond the app store — or consider whether they need a smart TV at all.