Microsoft Reports Medusa Ransomware Group Rapidly Exploits Vulnerabilities
Summary
Microsoft reports that Medusa operators, tracked as Storm-1175, rapidly exploit newly disclosed and zero-day vulnerabilities, then move to credential theft, data exfiltration and encryption. The group has reportedly hit more than 300 critical-infrastructure targets.
Key points
- Microsoft says Medusa, a ransomware-as-a-service group active since 2021, had hit more than 300 critical-infrastructure organizations by February 2025.
- Storm-1175 has exploited at least 16 vulnerabilities across products including Microsoft Exchange, Ivanti, SAP NetWeaver and GoAnywhere MFT; Microsoft says it exploited a NetWeaver flaw one day after public disclosure.
- Microsoft attributes at least three zero-day exploitations to the group, citing CVE-2026-23760 in SmarterMail and CVE-2025-10035 in GoAnywhere MFT among them.
- Operators reportedly move from initial access to post-compromise activity within hours or days, and may exfiltrate data and deploy file-encrypting ransomware within a day.
- Reported activity includes web shells or remote-access payloads, persistence, reconnaissance, lateral movement, credential theft and firewall changes; targets have included Linux systems and Oracle WebLogic instances.
- Microsoft says the group uses tools including PowerShell, PsExec, Impacket, Mimikatz and Rclone, and has used scripts to recover passwords from Veeam backup software.
Article Details
- Event Type
- Ransomware campaign involving rapid exploitation of vulnerabilities, including zero-days, and double extortion.
- Impact
- Microsoft reports that Medusa had hit more than 300 organizations in the critical infrastructure sector by February 2025. Recent attacks reportedly affected healthcare, education, professional services, and finance organizations in Australia, the United Kingdom, and the United States. The attacks involve data theft and encryption, creating risks of downtime, public data exposure, and downstream consequences.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe operators used Remote Desktop Protocol (RDP) to enable remote access.T1059.001 · PowerShellPowerShell is identified among the living-off-the-land binaries used by the operators.T1078 · Valid AccountsMicrosoft says the operators used administrator credentials to connect to remote hosts and deploy ransomware to additional systems.T1190 · Exploit Public-Facing ApplicationMicrosoft reports that Medusa operators exploit vulnerabilities in web-facing systems for initial access.T1486 · Data Encrypted for ImpactThe ransomware encrypts victims’ files.T1562.004 · Disable or Modify System FirewallThe operators modified firewall settings to enable remote access.T1566 · PhishingThe article says the group relies on phishing for initial access.T1569.002 · Service ExecutionThe article identifies PsExec as a tool used by the operators.
CVE
CVE-2025-10035Fortra · GoAnywhere MFTAccording to Microsoft, the group has exploited at least three zero-day flaws, including CVE-2026-23760 (SmarterMail) and CVE-2025-10035 (GoAnywhere MFT).CVE-2026-23760SmarterTools · SmarterMailAccording to Microsoft, the group has exploited at least three zero-day flaws, including CVE-2026-23760 (SmarterMail) and CVE-2025-10035 (GoAnywhere MFT).
People
Threat Actors
MedusaMicrosoft describes Medusa as a ransomware group operating a RaaS and reports that its operators rapidly exploit vulnerabilities, steal data, and encrypt victims’ systems.Storm-1175Microsoft’s tracking designation for the Medusa operators discussed in the article; Microsoft reports that they rapidly exploit vulnerabilities and conduct post-compromise operations.
Malware
Vendors
BeyondTrustJetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.ConnectWiseat least 16 vulnerabilities in Microsoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail,Ivantiyears, Medusa’s operators have exploited at least 16 vulnerabilities in Microsoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAPJetBrainsin Microsoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.MicrosoftThe Medusa ransomware group has been operating at a fast pace, seizing short windows of opportunity in attacks across multiple verticals, Microsoft says.OracleIt has also targeted Linux systems, including Oracle WebLogic instances.SAPIvanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.Veeamthat after gaining administrator credentials, Storm-1175 has used a script to recover passwords from Veeam backup software, which is used to connect to remote hosts, therefore enabling ransomware deployment to
Products
BeyondTrustJetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.ConnectWise ScreenConnect16 vulnerabilities in Microsoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, andCrushFTPSecure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.Fortra GoAnywhere MFTPolicy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.Ivanti Connect SecureMedusa’s operators have exploited at least 16 vulnerabilities in Microsoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver,JetBrains TeamCityMicrosoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.Microsoft ExchangeOver the past three years, Medusa’s operators have exploited at least 16 vulnerabilities in Microsoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity,Oracle WebLogicIt has also targeted Linux systems, including Oracle WebLogic instances.PaperCutpast three years, Medusa’s operators have exploited at least 16 vulnerabilities in Microsoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAPPolicy Securehave exploited at least 16 vulnerabilities in Microsoft Exchange, Papercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT,SAP NetWeaverIvanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.SimpleHelpPapercut, Ivanti Connect Secure and Policy Secure, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.SmarterMailConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, SAP NetWeaver, CrushFTP, GoAnywhere MFT, SmarterMail, and BeyondTrust.Veeam backup softwareafter gaining administrator credentials, Storm-1175 has used a script to recover passwords from Veeam backup software, which is used to connect to remote hosts, therefore enabling ransomware deployment to additional
Tools
Bandizipfor payload execution, Impacket and Mimikatz for lateral movement and credential harvesting, and Bandizip and Rclone for data collection and exfiltration.Impacket(RDP), various remote monitoring and management (RMM) tools, PDQ Deployer for payload execution, Impacket and Mimikatz for lateral movement and credential harvesting, and Bandizip and Rclone for data collectionMimikatzvarious remote monitoring and management (RMM) tools, PDQ Deployer for payload execution, Impacket and Mimikatz for lateral movement and credential harvesting, and Bandizip and Rclone for data collection andPDQ Deployertunnels, Remote Desktop Protocol (RDP), various remote monitoring and management (RMM) tools, PDQ Deployer for payload execution, Impacket and Mimikatz for lateral movement and credential harvesting, andPowerShellThe hackers have been using living-off-the-land binaries such as PowerShell and PsExec, along with Cloudflare tunnels, Remote Desktop Protocol (RDP), various remote monitoring and management (RMM) tools, PDQ DeployerPsExecThe hackers have been using living-off-the-land binaries such as PowerShell and PsExec, along with Cloudflare tunnels, Remote Desktop Protocol (RDP), various remote monitoring and management (RMM) tools, PDQ DeployerRClonepayload execution, Impacket and Mimikatz for lateral movement and credential harvesting, and Bandizip and Rclone for data collection and exfiltration.
Countries
Australiaorganizations, as well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States,” Microsoft says.United Kingdomas well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States,” Microsoft says.United Statesthe education, professional services, and finance sectors in Australia, the United Kingdom, and the United States,” Microsoft says.
Industries
Critical infrastructureOperating as a ransomware-as-a-service (RaaS), Medusa has been active since June 2021 and hit over 300 organizations in the critical infrastructure sector by February 2025.Educationsuccessful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States,”financeimpacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States,” Microsoft says.Healthcareidentifying exposed perimeter assets have proven successful, with recent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors inProfessional Servicesrecent intrusions heavily impacting healthcare organizations, as well as those in the education, professional services, and finance sectors in Australia, the United Kingdom, and the United States,” Microsoft says.