# Storm-1175 Medusa Ransomware Zero-Day Exploitation Campaign (CVE-2026-23760, CVE-2025-10035)

> Microsoft Threat Intelligence linked Storm-1175, a China-based financially motivated threat group, to high-tempo Medusa ransomware operations exploiting zero-day vulnerabilities in SmarterMail (CVE-2026-23760, CVSS 9.8) and GoAnywhere MFT (CVE-2025-10035, CVSS 10.0). The group achieves initial access via unauthenticated exploits against public-facing applications, deploys RMM tools for persistence, exfiltrates data via Rclone over Cloudflare tunnels, and detonates Medusa ransomware within 24 hours of entry. Over 300 critical infrastructure organizations impacted across the US, UK, and Australia.

- **Published:** 2026-04-06T12:00:00Z
- **Last reviewed:** 2026-04-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0326
- **ID:** TL-2026-0326
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Storm-1175 (China)
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-23760, CVE-2025-10035, CVE-2025-52691, CVE-2026-1731, CVE-2025-31161, CVE-2024-57726, CVE-2024-57727, CVE-2024-57728, CVE-2024-27198, CVE-2024-27199, CVE-2024-1709, CVE-2024-1708, CVE-2023-46805, CVE-2024-21887, CVE-2023-27350, CVE-2023-27351, CVE-2023-21529

## Description

Storm-1175 is a China-based, financially motivated cybercriminal group tracked by Microsoft Threat Intelligence, operating as an affiliate within the Medusa ransomware-as-a-service (RaaS) ecosystem. The group is characterized by exceptionally high operational tempo and proficiency in identifying and exploiting vulnerable, internet-facing assets — often achieving full ransomware deployment within 24 hours of initial compromise.

## Primary Exploit Vectors

The campaign leverages two critical zero-day vulnerabilities as primary entry points:

**CVE-2026-23760 — SmarterMail Authentication Bypass (CVSS 9.8)**
An authentication bypass vulnerability in SmarterTools SmarterMail prior to build 9511. The `/api/v1/auth/force-reset-password` endpoint is marked `AllowAnonymous` and fails to verify the existing password or require a valid reset token when the `IsSysAdmin` parameter is set to `true`. An unauthenticated attacker can reset the system administrator password by sending a crafted POST request, achieving full admin account takeover. From the admin panel, the attacker can achieve SYSTEM-level remote code execution via System Event hooks (domain creation triggers) or Volume Mount command injection. PoC exploit code is publicly available and a Nuclei detection template exists. CISA added this CVE to the Known Exploited Vulnerabilities catalog with a remediation due date of February 16, 2026. In-the-wild exploitation was first observed on January 17, 2026 — just two days after the patch release — indicating attackers reverse-engineered the security fix via decompiler analysis.

**CVE-2025-10035 — GoAnywhere MFT Deserialization RCE (CVSS 10.0)**
A critical deserialization vulnerability in Fortra GoAnywhere MFT's License Servlet affecting versions prior to 7.6.3 and 7.7.0 through 7.8.3. The flaw permits an attacker with a forged license response signature to deserialize an arbitrary attacker-controlled object, leading to command injection and unauthenticated remote code execution. Exploitation was first detected on September 11, 2025, seven days before Fortra released a patch on September 18, 2025, confirming true zero-day status. CISA added this to the KEV catalog with a due date of October 20, 2025.

## Full Attack Chain

Storm-1175 follows a consistent, rapid operational playbook:

1. **Initial Access**: Exploit CVE-2026-23760 (SmarterMail auth bypass → admin RCE) or CVE-2025-10035 (GoAnywhere deserialization → RCE). The group has also historically exploited CVE-2023-21529 (Exchange), CVE-2023-27350/27351 (PaperCut), CVE-2023-46805/CVE-2024-21887 (Ivanti), CVE-2024-1709/1708 (ScreenConnect), CVE-2024-27198/27199 (TeamCity), CVE-2024-57726/57727/57728 (SimpleHelp), CVE-2025-31161 (CrushFTP), and CVE-2026-1731 (BeyondTrust).

2. **Persistence**: Deploy remote monitoring and management (RMM) tools including SimpleHelp and MeshAgent under the compromised application process. Create unauthorized local and domain administrator accounts. Plant .jsp web shells within MFT application directories for backup access.

3. **Defense Evasion**: Clear command history, use obfuscated/encrypted payloads, disable or modify endpoint security tools using KillAV and AbyssWorker (BYOVD — Bring Your Own Vulnerable Driver technique).

4. **Credential Access**: Dump LSASS memory using Mimikatz to harvest domain credentials.

5. **Discovery**: Execute network scanning with Netscan and Advanced IP Scanner to map the environment. Enumerate network shares, system configurations, domain groups, and user permissions.

6. **Lateral Movement**: Leverage stolen credentials with Remote Desktop Protocol (mstsc.exe), PsExec for remote command execution, and software deployment tools (PDQ Deploy, BigFix) to propagate across the network.

7. **Command and Control**: Establish C2 communications through deployed RMM tools and Cloudflare tunnels, providing encrypted and resilient command channels that blend with legitimate traffic.

8. **Exfiltration**: Deploy Rclone to exfiltrate sensitive data to attacker-controlled cloud storage. Exfiltration volumes exceeding 70 GiB have been observed in a single incident. Robocopy is also used for staging data prior to exfiltration.

9. **Impact**: Deploy Medusa ransomware (gaze.exe) encrypting files with the .MEDUSA extension and dropping !!!READ_ME_MEDUSA!!!.txt ransom notes. Inhibit system recovery by deleting shadow copies and disabling recovery options. Medusa operates a double-extortion model — threatening to publish stolen data on their leak site if ransom is not paid.

## Scope and Impact

As of the CISA/FBI joint advisory (AA25-071A, March 2025), Medusa ransomware has impacted over 300 critical infrastructure organizations. Storm-1175's high-tempo operations have significantly expanded this count through 2025-2026, with particular focus on healthcare, education, professional services, financial, and critical infrastructure sectors across the United States, United Kingdom, and Australia. The group's ability to chain multiple zero-day exploits and achieve ransomware deployment within 24 hours represents an elevated threat to organizations running any of the 10+ affected products.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1047 Windows Management Instrumentation
- T1136 Create Account
- T1505 Server Software Component
- T1078 Valid Accounts
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1211 Exploitation for Stealth
- T1003 OS Credential Dumping
- T1046 Network Service Discovery
- T1016 System Network Configuration Discovery
- T1135 Network Share Discovery
- T1082 System Information Discovery
- T1069 Permission Groups Discovery
- T1021 Remote Services
- T1072 Software Deployment Tools
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1572 Protocol Tunneling
- T1567 Exfiltration Over Web Service
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery

## Sources

- [Microsoft: Storm-1175 Medusa Ransomware Operations](https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/)
- [BleepingComputer: Microsoft Links Medusa Affiliate to Zero-Day Attacks](https://www.bleepingcomputer.com/news/security/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks/)
- [CISA #StopRansomware: Medusa Ransomware Advisory AA25-071A](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a)
- [NVD: CVE-2026-23760 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-23760)
- [NVD: CVE-2025-10035 Detail](https://nvd.nist.gov/vuln/detail/CVE-2025-10035)
- [WatchTowr: SmarterMail Auth Bypass Analysis (WT-2026-0001)](https://labs.watchtowr.com/attackers-with-decompilers-strike-again-smartertools-smartermail-wt-2026-0001-auth-bypass/)
- [Huntress: SmarterMail Account Takeover Leading to RCE](https://www.huntress.com/blog/smartermail-account-takeover-leading-to-rce)
- [CVE-2026-23760 PoC Exploit (GitHub)](https://github.com/MaxMnMl/smartermail-CVE-2026-23760-poc)
- [Microsoft: Investigating CVE-2025-10035 GoAnywhere MFT Exploitation](https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/)
- [Fortra Security Advisory FI-2025-012 (GoAnywhere MFT)](https://www.fortra.com/security/advisories/product-security/fi-2025-012)
- [SOC Prime: CVE-2025-10035 Detection for Storm-1175](https://socprime.com/blog/detect-cve-2025-10035-exploitation/)
- [Darktrace: Under Medusa's Gaze — RMM Abuse in Ransomware Campaigns](https://www.darktrace.com/blog/under-medusas-gaze-how-darktrace-uncovers-rmm-abuse-in-ransomware-campaigns)
- [Picus Security: Medusa Ransomware CISA Alert AA25-071A Analysis](https://www.picussecurity.com/resource/blog/medusa-ransomware-cisa-alert-aa25-071a)
- [SecurityAffairs: GoAnywhere MFT Zero-Day Used by Storm-1175](https://securityaffairs.com/183075/hacking/goanywhere-mft-zero-day-used-by-storm-1175-in-medusa-ransomware-campaigns.html)
- [SmarterTools Release Notes (Patch)](https://www.smartertools.com/smartermail/release-notes/current)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0326