--- title: Microsoft links Medusa ransomware affiliate to zero-day... description: Microsoft has attributed Storm-1175, a China-based financially motivated cybercriminal group, to high-velocity Medusa ransomware attacks leveraging both n-day... canonical: https://daily.dev/posts/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks-fhrugbp6z twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Microsoft links Medusa ransomware affiliate to zero-day attacks | daily.dev og:description: Microsoft has attributed Storm-1175, a China-based financially motivated cybercriminal group, to high-velocity Medusa ransomware attacks leveraging both n-day... og:url: https://daily.dev/posts/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks-fhrugbp6z og:image: https://api.daily.dev/og/posts/FHRuGbP6Z.png og:image:alt: Microsoft links Medusa ransomware affiliate to zero-day attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Microsoft links Medusa ransomware affiliate to zero-day attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary Microsoft has attributed Storm-1175, a China-based financially motivated cybercriminal group, to high-velocity Medusa ransomware attacks leveraging both n-day and zero-day exploits. The group weaponizes new vulnerabilities rapidly — sometimes within a day of disclosure or even before patches are released — and has exploited over 16 vulnerabilities across 10 software products including Microsoft Exchange, Ivanti, GoAnywhere MFT, SmarterMail, and others. Storm-1175 moves quickly from initial access to data exfiltration and ransomware deployment, often within 24 hours, heavily targeting healthcare, education, finance, and professional services sectors in Australia, the UK, and the US. CISA previously warned that Medusa ransomware had impacted over 300 critical infrastructure organizations in the US. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [CISA: Medusa ransomware hit over 500 critical infrastructure orgs](https://daily.dev/posts/cisa-medusa-ransomware-hit-over-500-critical-infrastructure-orgs-elq8fhvwl) · BleepingComputer · 0 upvotes · 0 comments - [Lazarus Group targets healthcare orgs with Medusa ransomware](https://daily.dev/posts/lazarus-group-targets-healthcare-orgs-with-medusa-ransomware-uxilrpq3y) · The Register · 0 upvotes · 0 comments - [Lazarus Group Picks a New Poison: Medusa Ransomware](https://daily.dev/posts/lazarus-group-picks-a-new-poison-medusa-ransomware-plk9atyu6) · Dark Reading · 0 upvotes · 0 comments - [New StormEncryptor ransomware used by former Medusa affiliate](https://daily.dev/posts/new-stormencryptor-ransomware-used-by-former-medusa-affiliate-wtdite0wy) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#microsoft](https://daily.dev/tags/microsoft), [#ransomware](https://daily.dev/tags/ransomware), [#security](https://daily.dev/tags/security), [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks-fhrugbp6z) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Microsoft links Medusa ransomware affiliate to zero-day attacks","url":"https://daily.dev/posts/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks-fhrugbp6z","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks-fhrugbp6z"},"datePublished":"2026-04-06T16:57:27.985Z","dateModified":"2026-10-15T02:24:13.764Z","description":"Microsoft has attributed Storm-1175, a China-based financially motivated cybercriminal group, to high-velocity Medusa ransomware attacks leveraging both n-day...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2849742d86a5fc526dfe5e222b0149b3?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2849742d86a5fc526dfe5e222b0149b3?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks-fhrugbp6z","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"microsoft,ransomware,security,zero-day","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Microsoft links Medusa ransomware affiliate to zero-day attacks"}]} ```