Breach Autopsy: Microsoft Ties Storm-1175 to High-Tempo Medusa Ransomware Operations
Breach Autopsy: Microsoft Ties Storm-1175 to High-Tempo Medusa Ransomware Operations
Microsoft reported on April 6, 2026 that threat actor Storm-1175 is running rapid intrusion-to-encryption operations and chaining vulnerable internet-facing systems into Medusa ransomware campaigns. The activity pattern matters for defenders because it compresses the detection window: initial access, privilege movement,
