Storm-1175: How a High-Tempo Cybercrime Group Exploits the Patch Gap
A financially motivated cybercrime group, identified as Storm-1175, has been conducting a relentless campaign of Medusa ransomware attacks for three years. According to a recent Microsoft report, the group’s success hinges on a simple, brutal strategy: exploiting the critical window between when a software vulnerability is disclosed and when organizations manage to patch it. This focus on the patch gap has made the Storm-1175 ransomware operation particularly damaging.
Building on this, the group’s operational speed is a key differentiator. Microsoft notes that Storm-1175 can move from initial network access to full ransomware deployment in as little as one day, though the process sometimes takes up to six. This high tempo, combined with skill in finding exposed assets, has led to significant intrusions. Consequently, sectors like healthcare, education, professional services, and finance in Australia, the UK, and the US have borne the brunt of the attacks.
The Exploit Arsenal of Storm-1175
Since 2023, the group has weaponized at least 16 different vulnerabilities. Alarmingly, this includes three zero-day flaws—vulnerabilities exploited before the vendor is even aware or has issued a fix. A prime example is CVE-2025-10035, a flaw in GoAnywhere Managed File Transfer software, which Storm-1175 exploited a full week before it was publicly disclosed. This pattern underscores their proactive threat-hunting capabilities.
In addition to zero-days, the group heavily relies on n-day exploits—those targeting recently disclosed but still unpatched vulnerabilities. Their target list reads like a who’s who of enterprise software, including Ivanti Connect Secure, ConnectWise ScreenConnect, JetBrains TeamCity, and BeyondTrust. Therefore, any delay in applying security updates creates an immediate and exploitable opportunity for this actor.
Inside the Attack Chain: From Access to Encryption
Understanding their methods is crucial for defense. After breaching a network, often through an unpatched public-facing application, Storm-1175 follows a calculated playbook. First, they establish an initial foothold by deploying a web shell or a remote access payload. Immediately after, they work to ensure persistence, typically by creating a new user account and adding it to the local administrators group.
Lateral Movement and Evasion Tactics
With a secure beachhead established, the group begins reconnaissance and lateral movement. They adeptly use living-off-the-land binaries (LOLBins) like PowerShell and PsExec, which are native to Windows environments and harder to detect. To move between systems, they often deploy Cloudflare tunnels to channel traffic over Remote Desktop Protocol (RDP).
Furthermore, they employ multiple Remote Monitoring and Management (RMM) tools for post-compromise activities. These legitimate tools are repurposed to create accounts, establish backup command-and-control channels, and deliver final payloads. In some cases, they even use the software deployment tool PDQ Deployer to silently install malicious applications across the network. To avoid detection, they have been known to modify Microsoft Defender Antivirus settings in the Windows registry to prevent it from blocking their ransomware payload.
How Organizations Can Mitigate the Threat
Given the sophisticated and rapid nature of these Storm-1175 ransomware attacks, a proactive and layered defense is non-negotiable. Microsoft’s guidance starts with fundamental visibility. Organizations must use perimeter scanning tools to fully understand their external attack surface. Any web-facing system should be isolated from the public internet behind a secure network boundary and accessed strictly through a VPN.
For systems that must remain connected, placing them behind a Web Application Firewall (WAF), reverse proxy, or a demilitarized zone (DMZ) is essential. This creates an additional buffer that can filter malicious traffic before it reaches the core asset.
Critical Security Hardening Recommendations
On the internal network, several specific actions can drastically reduce risk. First, adhere to strict credential hygiene principles and implement measures to limit lateral movement, as outlined in general ransomware defense guidance. Enabling Credential Guard helps protect sensitive credentials stored in system memory from being harvested by tools like Impacket, which Storm-1175 sometimes uses.
Another vital step is to turn on tamper protection in your endpoint security solutions. This prevents attackers from disabling security services or creating antivirus exclusions, a tactic this group employs. Additionally, audit and remove any unapproved RMM software installations. For approved RMM tools, enforce multi-factor authentication (MFA) to block unauthorized access.
Finally, ensure your extended detection and response (XDR) tools are configured to recognize and block the common techniques seen in these attacks. By understanding the tools and TTPs of groups like Storm-1175, security teams can create more effective detection rules. The race between patching and exploitation defines modern cyber defense, and against a determined adversary like Storm-1175, speed and vigilance are everything.
CyberSecurity1 month ago
CyberSecurity1 month ago
CyberSecurity1 month ago
Infosecurity1 month ago
CyberSecurity1 month ago
Social Media1 month ago
CyberSecurity1 month ago
Social Media1 month ago