Storm-1175 is a financially motivated cybercriminal group, tracked by Microsoft Threat Intelligence, that emerged in 2023 and is assessed to be China-based. The group operates as a highly aggressive affiliate within the Medusa ransomware-as-a-service ecosystem. What distinctly sets Storm-1175 apart is their exceptional operational tempo, characterized by the rapid exploitation of newly disclosed (N-day) and zero-day vulnerabilities in internet-facing systems, often moving from initial access to data exfiltration and ransomware deployment within 24 hours. This compressed attack timeline significantly reduces the window for defenders to detect and respond to intrusions.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.