Storm-1175Threat actor
Storm-1175 is a cybercriminal group known for deploying Medusa ransomware and exploiting public-facing applications for initial access. They have been observed exploiting a critical deserialization vulnerability in GoAnywhere MFT, tracked as CVE-2025-10035, which could lead to command injection and potential RCE.From MISP Galaxy
Last reported 22 days ago, by Silent Push2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1684Social Engineering
“Its paid tiers advertise tools and personas for exploit research, reverse engineering, social engineering, and financial tracing.”
- T1110.004Credential Stuffing
“…ese apps, while not malware, can create exposure to internal resources and make a corporate IP address appear to be the source of credential stuffing, fraud, or other abusive activity.”
- T1195Supply Chain Compromise
“Supply-chain compromises targeted package managers and developer environments, including AI-enabled tooling, where compromised credentials, trusted integrations, and software distribution channels enabled propagation into downstream cloud and software ecosystems.”
- T1219Remote Access Tools
“Google’s threat-intelligence team and the FBI said the group uses fake IT-support calls, phishing emails, legitimate remote-access tools, and, in some cases, people impersonating technicians to gain physical access.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Weekly Cybersecurity Roundup: How Stolen Credentials Continue to Fuel Fraud“Microsoft linked STORM-1175 to exploitation of over 16 vulnerabilities since 2023, followed by data theft and Medusa deployment.”
-
H1 2026 Malware Vulnerability Trends“…ploitation playbooks across different initial vulnerabilities; StrikeShark applied the same six-tool stack across thirteen CVEs, while Storm-1175 linked credential theft, remote execution, data transfer, and ransomware tooling across ten.”
Indicators in its reports
named in the reports above- ntuser[.]manin 1 report
Copy this indicator · defanged
Thanks — we review every report.