Threat actor
Storm-1175
Tracked by CyberSIXT since 6 Apr · last activity 13 Aug
CNMalpedia
- CVEs linked · all time
- 9
- in CISA KEV · all time
- 9
- articles · all time
- 7
No articles in the last 45 daysThe latest: Security Affairs, Thu 13 Aug, 08:51 UTC.See the full timeline
CVEs
9 CVEsCVE-2025-10035Fortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityCVSS10.0CriticalExploited99.7%EPSS2articles
CVE-2026-1731BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityCVSS9.9CriticalExploited92%EPSS24articles
CVE-2024-27198JetBrains TeamCity Authentication Bypass VulnerabilityCVSS9.8CriticalExploited99.9%EPSS1article
CVE-2025-31161CrushFTP Authentication Bypass VulnerabilityCVSS9.8CriticalExploited99.9%EPSS2articles
CVE-2026-23760SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVSS9.3CriticalExploited96%EPSS10articles
CVE-2023-21529Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityCVSS8.8HighExploited59%EPSS7articles
CVE-2023-27351PaperCut NG/MF Improper Authentication VulnerabilityCVSS8.2HighExploited78%EPSS6articles
CVE-2023-46805Ivanti Connect Secure and Policy Secure Authentication Bypass VulnerabilityCVSS8.2HighExploited99.9%EPSS2articles
CVE-2026-18577N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityCVSS8.2HighExploited15%EPSS12articles
- Storm-1175 Replaces Medusa With New StormEncryptor RansomwareSecurity Affairs
- Storm-1175 Deploys Medusa Ransomware at 'High Velocity'Dark Reading
- China-linked Storm-1175 deploys Medusa ransomware within 24hSecurity Affairs
- Storm-1175 Exploits Flaws in High-Velocity Medusa AttacksInfosecurity
- China linked Medusa gang uses zero days to hit UK health, financeThe Hacker News
- Microsoft links Medusa ransomware affiliate to zero-day attacksDataBreaches
- Storm-1175 hackers use fresh flaws to drop Medusa ransomwareMicrosoft · first in our coverage