Storm-1175 Exploits Flaws in High-Velocity Medusa Attacks

**Executive summary:** Microsoft attributes a high-tempo Medusa ransomware campaign to Storm-1175, a financially motivated actor exploiting at least 16 vulnerabilities (including zero-days) to rapidly gain access and deploy ransomware across healthcare, education, professional services, and finance in Australia, the UK and the US; the report outlines the group's TTPs (web shells, new admin accounts, LOLBins, RMM tools, Cloudflare tunnels, PDQ Deployer, Impacket) and recommends perimeter hardening, credential hygiene, MFA, tamper protection, and XDR tuning.