CRITICALRansomware
Global

Microsoft links Medusa ransomware affiliate to zero-day attacks

Monday, April 6, 2026 at 04:56 PM UTC·Source: BleepingComputer

Updated: Monday, April 6, 2026 at 04:57 PM UTC

Executive Summary

Microsoft says that Storm-1175, a China-based financially motivated cybercriminal group known for deploying Medusa ransomware payloads, has been deploying n-day and zero-day exploits in high-velocity attacks. [...]

Analysis

Microsoft says that Storm-1175, a China-based financially motivated cybercriminal group known for deploying Medusa ransomware payloads, has been deploying n-day and zero-day exploits in high-velocity attacks. [...]
Source Attribution

Originally published by BleepingComputer on Apr 6, 2026.

Related Threats

CRITICALRansomware

Medusa ransomware group using zero-days to launch attacks within 24 hours of breach, Microsoft says

Microsoft said it has been alarmed to see how effective Medusa actors are, citing multiple cases where the group can move from initial access to data exfiltration and ransomware deployment within 24 hours.

The Record
HIGHRansomware

German police unmask two suspects linked to REvil ransomware gang

The suspects were named as Daniil Shchukin, a 31-year-old Russian national believed to have used the alias UNKN (UNKNOWN), and Anatoly Kravchuk, a 43-year-old Ukraine-born Russian citizen who investigators say worked as a developer for the group.

The Record
HIGHRansomware

Germany Doxes “UNKN,” Head of RU Ransomware Gangs REvil, GandCrab

Brian Krebs reports: An elusive hacker who went by the handle “UNKN” and ran the early Russian ransomware groups GandCrab and REvil now has a name and a face. Authorities in Germany say 31-year-old Russian Daniil Maksimovich Shchukin headed both cybercrime gangs and helped carry out at least 130 acts of computer sabotage and extortion against victims across the country between... Source

DataBreaches.net