Campaign DetailSource-backed corpus

ScreenConnect Exploitation and Storm-1175 / Medusa Operations

This card connects two source-bounded layers: broad multi-actor exploitation of the 2024 ScreenConnect authentication-bypass and path-traversal flaws, and Microsoft’s later named Storm-1175 campaign chain in which vulnerable web-facing assets, including ScreenConnect, can lead to credential theft, lateral movement, data exfiltration, security tampering, and Medusa ransomware. It does not assert that every 2024 ScreenConnect intrusion was Storm-1175 activity.

Last updated Jul 18, 2026, 7:30 PM EDT

Actor Mapping

Mapped Threat Actors

Storm-1175 MedusaUnattributed ScreenConnect operators

Targeting

Target Sectors / Countries

Cross-industryManaged Service ProvidersSMBsHealthcareProfessional ServicesTechnology

Tradecraft

ATT&CK / Techniques

T1190T1098T1078T1003T1021T1562.001T1560T1567T1486

Tools / Observables

Malware, Tools, CVEs

/SetupWizard.aspx/ alternate pathUser.xml resetnew administratorsunusual ScreenConnect sessions or commandsVeeam password recoveryPsExecNTDS.ditSAMDefender exclusionsBandizipRclonePDQ DeployerRunFileCopy.cmdMedusa ransomware

Source Reconciliation

How IntelliOS Is Treating This Campaign

Campaign rows are retained as source-backed context. Actor mappings do not automatically merge actor records; SOCRadar, MITRE, Mandiant, CrowdStrike, Microsoft, and other future sources can disagree on boundaries, aliases, or campaign ownership.

This is a connected exposure-and-campaign card, not a claim that one actor ran every ScreenConnect intrusion. CVE-2025-3935, the 2025 ConnectWise nation-state event, and 2026 rogue-client installation campaigns are separate tracks unless incident evidence establishes a connection.

Evidence Controls

Methodology / Claim Status

Reporting period: February 2024 through July 18, 2026
Methodology: Cross-source reconciliation of vendor remediation, government KEV status, incident-response observations, and Microsoft campaign telemetry
Sample scope: Multiple Huntress-observed 2024 intrusions plus Microsoft-observed Storm-1175 operations; no universal victim count asserted
Claim status: Exploitation and named campaign chain confirmed; actor and victim conclusions remain source- and incident-specific

IntelliOS

Related Intel Products

PANDA Flash Threat Intel BriefScreenConnect Exploitation Creates MSP-to-Customer Ransomware ExposureThe 32-card source-backed briefing, scoping, and response product for this exposure and campaign context.

Citations

Source Trust / Citations

[1] Microsoft: Storm-1175 high-tempo Medusa operationsMicrosoft Threat Intelligence
[2] Huntress: SlashAndGrab post-exploitation in the wildHuntress
[3] ConnectWise: ScreenConnect 23.9.8 security fixConnectWise
[4] CISA: Known Exploited Vulnerabilities CatalogCISA