RansomwarecriticalExploited in the wild

Fast-moving Storm-1175 uses new exploits to breach networks and drop Medusa

Security Affairsby @securityaffairsApr 7, 2026 · 13:21 UTC (Apr 7, 2026)3 min read3 · 1 read

Read at securityaffairs.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2026-1731 CVE-2023-21529 CVE-2023-27351 CVE-2023-27350 CVE-2023-46805 CVE-2024-21887 CVE-2024-1709 CVE-2024-1708 CVE-2024-27198 CVE-2024-27199 CVE-2024-57726 CVE-2024-57727 CVE-2024-57728 CVE-2025-10035 CVE-2025-52691 CVE-2026-23760

Tags: cve-2023-21529 cve-2023-27350 cve-2023-27351 cve-2023-46805 cve-2026-1731 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-21529	Authenticated Deserialization RCE in Microsoft Exchange Server (CVE-2023-21529)	8.8	59%	KEVRansomware	Feb 14, 2023 KEV Apr 13, 2026
CVE-2023-27350	Authentication Bypass Leading to SYSTEM RCE in PaperCut MF/NG	9.8	100%	KEVRansomwarePoC ×3	Apr 20, 2023 KEV Apr 21, 2023
CVE-2023-27351	Authentication Bypass in PaperCut NG/MF Print Management Software	7.5	78%	KEVRansomware	Apr 20, 2023 KEV Apr 20, 2026
CVE-2024-21887 +1 related CVE CVE-2023-46805	Command Injection RCE in Ivanti Connect Secure and Policy Secure	9.1 group max	100%	KEVRansomwarePoC	Jan 12, 2024 KEV Jan 10, 2024
CVE-2024-1709 +1 related CVE CVE-2024-1708	Authentication Bypass in ConnectWise ScreenConnect Creates Rogue Admin Accounts	10.0 group max	100%	KEVRansomwarePoC ×3	Feb 21, 2024 KEV Feb 22, 2024
CVE-2024-27198 +1 related CVE CVE-2024-27199	Authentication Bypass in JetBrains TeamCity CI/CD Server	9.8 group max	100%	KEVRansomware	Mar 4, 2024 KEV Mar 7, 2024
CVE-2024-57726 +2 related CVEs CVE-2024-57727 CVE-2024-57728	Missing-Authorization Privilege Escalation in SimpleHelp Remote Support <= 5.5.7	9.9 group max	66%	KEVRansomware	Jan 15, 2025 KEV Apr 24, 2026
CVE-2025-10035	Deserialization Flaw in Fortra GoAnywhere MFT License Servlet Enables RCE	9.8	100%	KEVRansomwarePoC	Sep 18, 2025 KEV Sep 29, 2025
CVE-2025-52691	Unauthenticated Arbitrary File Upload RCE in SmarterTools SmarterMail	10.0	86%	KEVRansomwarePoC ×2	Dec 29, 2025 KEV Jan 26, 2026
CVE-2026-1731	Pre-Authentication OS Command Injection RCE in BeyondTrust Remote Support and PRA	9.9	93%	KEVRansomwarePoC	Feb 6, 2026 KEV Feb 13, 2026
CVE-2026-23760	Unauthenticated Admin Password Reset Bypass in SmarterTools SmarterMail	9.3	96%	KEVRansomwarePoC ×2	Jan 22, 2026 KEV Jan 26, 2026

From the original article

3 min read at securityaffairs.com

China-based actor Storm-1175 runs fast ransomware attacks, exploiting new flaws to breach systems and quickly deploy Medusa ransomware. China-based actor Storm-1175 carries out fast, financially driven ransomware attacks by exploiting newly disclosed vulnerabilities before organizations patch them.

Security Affairs

By @securityaffairs · securityaffairs.com

Read the full article at Security Affairs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.