Storm-1175

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat China

Primary Aliases: G1051 Medusa Actors Medusa Blog Medusa Group

Sponsor / State Affiliation China-linked (Cybercriminal)

Primary Motivation Financial gain via ransomware and extortion

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Medusa Ransomware Operations, StormEncryptor Pivot

⚔️ Weaponized CVE Matrix (1)

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Healthcare Education Professional Services Finance

🛡️ MITRE ATT&CK® Attack Lifecycle (8 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Exploitation of public-facing assets (e.g., N-able N-central, GoAnywhere MFT)

Persistence & Privilege Escalation 1

T1547 Persistence via masqueraded Cloudflare tunnels

Defense Evasion 1

T1027 Defense evasion through security solution tampering and Defender exclusions

Credential Access & Discovery 1

T1003 Credential theft via Mimikatz and LSASS dumping

Lateral Movement & Collection 1

T1021 Lateral movement using PsExec, RDP, and PDQ Deployer

Command & Control 2

T1071 Abuse of Remote Monitoring and Management (RMM) tools (AnyDesk, SimpleHelp)

T1071 Data exfiltration via Rclone and Bandizip

Operational Techniques 1

T1000 Weaponization of N-day and zero-day vulnerabilities

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

No recent breaking campaign alerts recorded in the FlagThis threat database.

Copied to clipboard

LINK COPIED TO CLIPBOARD