Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035)

Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (TL-2026-0326), also tracked as Medusa RaaS, is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-04-06. It is attributed to Storm-1175 (China) with high confidence, affects SmarterTools SmarterMail, references 17 CVEs (CVE-2026-23760, CVE-2025-10035, CVE-2025-52691), maps to 27 MITRE ATT&CK techniques (T1003, T1016, T1021), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-0326

Threat ID
TL-2026-0326
Also known as
Medusa RaaS, Operation Medusa Storm
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
RANSOMWARE
First published
2026-04-06
Last reviewed
2026-04-06
Attribution
Storm-1175
Attribution confidence
HIGH
Nation-state nexus
China
Motivation
FINANCIAL
Target sectors
healthcare, education, professional-services, finance, critical-infrastructure, technology, legal, insurance, manufacturing, government
Target regions
United States, United Kingdom, Australia
Detection rules
9
Indicators of compromise
31

Malware and tooling in Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign

Malware and tooling: MEDUSA - S1220, CloudFlare Tunnel, MeshAgent, Mimikatz, Netscan, Rclone - S1040, SimpleHelp

Microsoft Threat Intelligence linked Storm-1175, a China-based financially motivated threat group, to high-tempo Medusa ransomware operations exploiting zero-day vulnerabilities in SmarterMail (CVE-2026-23760, CVSS 9.8) and GoAnywhere MFT (CVE-2025-10035, CVSS 10.0). The group achieves initial access via unauthenticated exploits against public-facing applications, deploys RMM tools for persistence, exfiltrates data via Rclone over Cloudflare tunnels, and detonates Medusa ransomware within 24 hours of entry. Over 300 critical infrastructure organizations impacted across the US, UK, and Australia.

How Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign works

Storm-1175 is a China-based, financially motivated cybercriminal group tracked by Microsoft Threat Intelligence, operating as an affiliate within the Medusa ransomware-as-a-service (RaaS) ecosystem. The group is characterized by exceptionally high operational tempo and proficiency in identifying and exploiting vulnerable, internet-facing assets — often achieving full ransomware deployment within 24 hours of initial compromise.

## Primary Exploit Vectors

The campaign leverages two critical zero-day vulnerabilities as primary entry points:

**CVE-2026-23760 — SmarterMail Authentication Bypass (CVSS 9.8)** An authentication bypass vulnerability in SmarterTools SmarterMail prior to build 9511. The `/api/v1/auth/force-reset-password` endpoint is marked `AllowAnonymous` and fails to verify the existing password or require a valid reset token when the `IsSysAdmin` parameter is set to `true`. An unauthenticated attacker can reset the system administrator password by sending a crafted POST request, achieving full admin account takeover. From the admin panel, the attacker can achieve SYSTEM-level remote code execution via System Event hooks (domain creation triggers) or Volume Mount command injection. PoC exploit code is publicly available and a Nuclei detection template exists. CISA added this CVE to the Known Exploited Vulnerabilities catalog with a remediation due date of February 16, 2026. In-the-wild exploitation was first observed on January 17, 2026 — just two days after the patch release — indicating attackers reverse-engineered the security fix via decompiler analysis.

**CVE-2025-10035 — GoAnywhere MFT Deserialization RCE (CVSS 10.0)** A critical deserialization vulnerability in Fortra GoAnywhere MFT's License Servlet affecting versions prior to 7.6.3 and 7.7.0 through 7.8.3. The flaw permits an attacker with a forged license response signature to deserialize an arbitrary attacker-controlled object, leading to command injection and unauthenticated remote code execution. Exploitation was first detected on September 11, 2025, seven days before Fortra released a patch on September 18, 2025, confirming true zero-day status. CISA added this to the KEV catalog with a due date of October 20, 2025.

## Full Attack Chain

Storm-1175 follows a consistent, rapid operational playbook:

1. **Initial Access**: Exploit CVE-2026-23760 (SmarterMail auth bypass → admin RCE) or CVE-2025-10035 (GoAnywhere deserialization → RCE). The group has also historically exploited CVE-2023-21529 (Exchange), CVE-2023-27350/27351 (PaperCut), CVE-2023-46805/CVE-2024-21887 (Ivanti), CVE-2024-1709/1708 (ScreenConnect), CVE-2024-27198/27199 (TeamCity), CVE-2024-57726/57727/57728 (SimpleHelp), CVE-2025-31161 (CrushFTP), and CVE-2026-1731 (BeyondTrust).

2. **Persistence**: Deploy remote monitoring and management (RMM) tools including SimpleHelp and MeshAgent under the compromised application process. Create unauthorized local and domain administrator accounts. Plant .jsp web shells within MFT application directories for backup access.

3. **Defense Evasion**: Clear command history, use obfuscated/encrypted payloads, disable or modify endpoint security tools using KillAV and AbyssWorker (BYOVD — Bring Your Own Vulnerable Driver technique).

4. **Credential Access**: Dump LSASS memory using Mimikatz to harvest domain credentials.

5. **Discovery**: Execute network scanning with Netscan and Advanced IP Scanner to map the environment. Enumerate network shares, system configurations, domain groups, and user permissions.

6. **Lateral Movement**: Leverage stolen credentials with Remote Desktop Protocol (mstsc.exe), PsExec for remote command execution, and software deployment tools (PDQ Deploy, BigFix) to propagate across the network.

7. **Command and Control**: Establish C2 communications through deployed RMM tools and Cloudflare tunnels, providing encrypted and resilient command channels that blend with legitimate traffic.

8. **Exfiltration**: Deploy Rclone to exfiltrate sensitive data to attacker-controlled cloud storage. Exfiltration volumes exceeding 70 GiB have been observed in a single incident. Robocopy is also used for staging data prior to exfiltration.

9. **Impact**: Deploy Medusa ransomware (gaze.exe) encrypting files with the .MEDUSA extension and dropping !!!READ_ME_MEDUSA!!!.txt ransom notes. Inhibit system recovery by deleting shadow copies and disabling recovery options. Medusa operates a double-extortion model — threatening to publish stolen data on their leak site if ransom is not paid.

## Scope and Impact

As of the CISA/FBI joint advisory (AA25-071A, March 2025), Medusa ransomware has impacted over 300 critical infrastructure organizations. Storm-1175's high-tempo operations have significantly expanded this count through 2025-2026, with particular focus on healthcare, education, professional services, financial, and critical infrastructure sectors across the United States, United Kingdom, and Australia. The group's ability to chain multiple zero-day exploits and achieve ransomware deployment within 24 hours represents an elevated threat to organizations running any of the 10+ affected products.

MITRE ATT&CK techniques used in TL-2026-0326

credential-access

T1003 OS Credential Dumping

discovery

T1016 System Network Configuration Discovery; T1046 Network Service Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1135 Network Share Discovery

lateral-movement

T1021 Remote Services

defense-evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1078 Valid Accounts; T1211 Exploitation for Stealth

execution

T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1072 Software Deployment Tools

command-and-control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1219 Remote Access Tools; T1572 Protocol Tunneling

collection

T1074 Data Staged

persistence

T1136 Create Account; T1505 Server Software Component

initial-access

T1190 Exploit Public-Facing Application; T1566 Phishing

impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery

exfiltration

T1567 Exfiltration Over Web Service

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign

  • SmarterTools — SmarterMail
    Vulnerable versions: All versions prior to build 9511
    Fixed in: Build 9511 (2026-01-15); Build 9518 (2026-01-22)
  • Fortra — GoAnywhere MFT
    Vulnerable versions: Versions prior to 7.6.3; Versions 7.7.0 through 7.8.3
    Fixed in: 7.6.3; 7.8.4
  • Microsoft — Exchange Server
    Vulnerable versions: Exchange Server 2019
    Fixed in: Patched via CVE-2023-21529 update
  • PaperCut — PaperCut NG/MF
    Vulnerable versions: Versions prior to 22.1.3
    Fixed in: 22.1.3+
  • Ivanti — Connect Secure / Policy Secure
    Vulnerable versions: Connect Secure 9.x, 22.x; Policy Secure 9.x, 22.x
    Fixed in: Patched versions per Ivanti advisory
  • ConnectWise — ScreenConnect
    Vulnerable versions: Versions prior to 23.9.8
    Fixed in: 23.9.8+
  • JetBrains — TeamCity
    Vulnerable versions: Versions prior to 2023.11.4
    Fixed in: 2023.11.4+
  • SimpleHelp — SimpleHelp Remote Support
    Vulnerable versions: Versions prior to 5.5.8
    Fixed in: 5.5.8+
  • CrushFTP — CrushFTP
    Vulnerable versions: Versions prior to 10.8.4 / 11.3.1
    Fixed in: 10.8.4+; 11.3.1+
  • BeyondTrust — Privileged Remote Access / Remote Support
    Vulnerable versions: Affected versions per CVE-2026-1731
    Fixed in: Patched versions per BeyondTrust advisory

Remediation for Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign

Patches

  • SmarterMail: Upgrade to build 9511 or later (fixes CVE-2026-23760)
  • GoAnywhere MFT: Upgrade to version 7.6.3+ or 7.8.4+ (fixes CVE-2025-10035)
  • Apply all available patches for historically exploited products: Exchange, PaperCut, Ivanti, ScreenConnect, TeamCity, SimpleHelp, CrushFTP, BeyondTrust

Immediate actions

  • Block all known IOC IP addresses at perimeter firewalls and proxy systems
  • Audit all SmarterMail instances for unauthorized admin password resets — check auth logs for /api/v1/auth/force-reset-password requests
  • Audit GoAnywhere MFT instances for .jsp web shells in application directories
  • Hunt for SimpleHelp, MeshAgent, AnyDesk, and Atera RMM tools not sanctioned by IT
  • Monitor for Rclone execution and large outbound data transfers
  • Disable external RDP access and enforce MFA on all remote access paths
  • Isolate any systems showing indicators of compromise

Workarounds

  • If SmarterMail cannot be patched immediately, restrict access to port 9998 admin interface via firewall rules
  • If GoAnywhere MFT cannot be patched, restrict License Servlet access to trusted internal IPs only
  • Disable unused administrative API endpoints on all public-facing applications
  • Block Cloudflare tunnel egress if not operationally required

Longer-term hardening

  • Deploy EDR with behavioral detection for BYOVD attacks and RMM tool abuse
  • Implement network segmentation to limit lateral movement from DMZ to internal networks
  • Establish application allowlisting to prevent unauthorized RMM tool installation
  • Implement immutable offline backups tested regularly for ransomware recovery
  • Deploy SIEM detections for CVE-2026-23760 and CVE-2025-10035 exploitation patterns
  • Conduct tabletop exercises for ransomware incident response
  • Enforce principle of least privilege across all service accounts

CVEs associated with Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign

Weaknesses (CWE) in Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign

CWE-288, CWE-502, CWE-77

Timeline of Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign

  • Medusa ransomware-as-a-service variant first identified in the wild
  • CISA, FBI, and MS-ISAC publish joint advisory AA25-071A on Medusa ransomware — over 300 critical infrastructure organizations impacted
  • Storm-1175 begins actively exploiting CVE-2025-10035 (GoAnywhere MFT deserialization) as a zero-day — seven days before vendor patch
  • Fortra releases security advisory FI-2025-012 and patches for GoAnywhere MFT versions 7.6.3 and 7.8.4
  • Microsoft Threat Intelligence publishes investigation into active exploitation of CVE-2025-10035 by Storm-1175
  • SmarterTools releases SmarterMail build 9511 fixing CVE-2026-23760 authentication bypass
  • In-the-wild exploitation of CVE-2026-23760 detected — two days after patch release, attackers reverse-engineered the fix via decompiler analysis
  • WatchTowr Labs publishes detailed technical analysis of CVE-2026-23760; public PoC exploit code appears on GitHub
  • NVD publishes CVE-2026-23760 with CVSS 4.0 score of 9.3 and CVSS 3.1 score of 9.8
  • CISA KEV remediation deadline for CVE-2026-23760 — federal agencies required to have patched SmarterMail
  • Microsoft Threat Intelligence publishes comprehensive report linking Storm-1175 to Medusa ransomware operations exploiting both zero-days
  • As of 2026-05-29, Storm-1175 remains an active Medusa RaaS affiliate with no disruption/arrest; latest Microsoft reporting (Apr 6, 2026) confirms ongoing high-velocity N-day campaigns. Both CVEs are patched and in CISA KEV, but exploitation persists — CVE-2026-23760 (SmarterMail) was exploited in the wild two days post-patch.

Sources cited for Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign

Threats related to Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign

Detection coverage for TL-2026-0326

As of 2026-04-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0326 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats