Storm-1175 is a cybercriminal group deploying Medusa ransomware and exploiting a GoAnywhere MFT vulnerability (CVE-2025-10035).
Analyst brief
Storm-1175 is a cybercriminal group deploying Medusa ransomware and targeting public-facing applications for initial access. They actively exploit a critical deserialization vulnerability in GoAnywhere MFT (CVE-2025-10035), leading to command injection and potential RCE. Their post-compromise TTPs include creating a domain group named "ESX Admins." Defenders should immediately patch GoAnywhere MFT, monitor for unauthorized creation of "ESX Admins" groups, and track Medusa ransomware IOCs.
Storm-1175
activeunknown
Storm-1175 is a cybercriminal group known for deploying Medusa ransomware and exploiting public-facing applications for initial access. They have been observed exploiting a critical deserialization vulnerability in GoAnywhere MFT, tracked as CVE-2025-10035, which could lead to command injection and potential RCE. Microsoft Defender researchers identified exploitation activity aligned with TTPs attributed to Storm-1175, including the use of post-compromise techniques that involve creating a group named “ESX Admins” in the domain.