China-Linked Storm-1175 Exploits Zero-Days to Rapidly Deploy Medusa Ransomware

A China-linked threat actor, Storm-1175, has been observed employing a blend of zero-day and N-day vulnerabilities in rapid succession to breach internet-facing systems and deploy Medusa ransomware.

What happened

Security researchers have connected the Storm-1175 group to the exploitation of both zero-day and known N-day vulnerabilities. This combination allows the actor to carry out fast-moving attacks that compromise exposed network assets, facilitating the deployment of Medusa ransomware.

Why it matters

The use of zero-day and N-day exploits in high-tempo campaigns highlights the evolving tactics of ransomware groups and their capability to quickly penetrate and impact vulnerable systems, raising the importance of proactive vulnerability management.

Key technical details

Storm-1175 leverages a mix of unknown zero-day vulnerabilities alongside existing N-day exploits to target internet-facing systems. Their approach emphasizes rapid identification and exploitation of exposed perimeter assets, enabling swift and effective ransomware deployment.

Affected organizations/products

Internet-facing systems vulnerable to the exploited zero-day and N-day vulnerabilities; Medusa ransomware campaigns linked to Storm-1175

Source attribution

https://thehackernews.com/2026/04/china-linked-storm-1175-exploits-zero.html