Microsoft links Medusa ransomware affiliate to zero-day attacks

Microsoft reports that Storm-1175, a financially motivated cybercrime group deploying Medusa ransomware, has been rapidly weaponizing n-day and zero-day vulnerabilities—sometimes exploiting flaws days before patches—to gain access, chain exploits for persistence, steal credentials, disable defenses, and deploy ransomware. Recent campaigns have exploited more than 16 vulnerabilities across multiple products, impacted healthcare, education, professional services, and finance in AU/UK/US, and prompted a CISA/FBI/MS-ISAC advisory noting impacts to over 300 critical infrastructure organizations.