microsoft-threat-intel

Breach Autopsy: Microsoft Ties Storm-1175 to High-Tempo Medusa Ransomware Operations Microsoft reported on April 6, 2026 that threat actor Storm-1175 is running rapid intrusion-to-encryption operations and chaining vulnerable internet-facing systems into Medusa ransomware campaigns. The activity pattern matters for defenders because it compresses the detection window: initial access, privilege movement,