China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware

This article covers Storm-1175, a China-linked threat actor exploiting zero-day and N-day vulnerabilities to rapidly deploy Medusa ransomware against organizations in healthcare, education, finance, and professional services.

• •Storm-1175 has exploited over 16 vulnerabilities since 2023, including flaws in Microsoft Exchange, Ivanti, ConnectWise, JetBrains TeamCity, and BeyondTrust.
• •The group achieves initial access via zero-days—sometimes before public disclosure—and can deploy ransomware within 24 hours of compromise.
• •Post-compromise tactics include credential dumping with Mimikatz and Impacket, lateral movement via PDQ Deployer and LOLBins, and disabling Microsoft Defender Antivirus exclusions.
• •Data exfiltration is carried out using Bandizip for collection and Rclone for transfer, while RMM tools like AnyDesk and MeshAgent are abused for covert persistence.