Fast-moving Storm-1175 uses new exploits to breach networks and drop Medusa

Storm-1175 is a China-based, financially motivated group that rapidly weaponizes newly disclosed (and in some cases zero-day) vulnerabilities in internet-facing systems to gain access, chain exploits, deploy web shells and remote tools, steal credentials, move laterally, exfiltrate data, and deploy Medusa ransomware — often completing attacks within 24 hours against targets in healthcare, education, finance and services across the US, UK and Australia; Microsoft provided IoCs and mitigation guidance.