Storm-1175 public-facing intrusion wave

Storm-1175 is running a high-velocity intrusion campaign that uses **zero-day** and **N-day** vulnerabilities to break into exposed internet-facing systems. Available evidence ties the activity to products including **Microsoft Exchange Server**, **Ivanti Connect Secure and Policy Secure**, **ConnectWise ScreenConnect**, **JetBrains TeamCity**, **SimpleHelp**, **Fortra GoAnywhere MFT**, **SmarterTools SmarterMail**, and **BeyondTrust Remote Support and Privileged Remote Access**. The operators have also targeted Oracle WebLogic and Linux systems in recent activity, showing that the intrusion pattern is not limited to a single product line. After foothold acquisition, the group moves quickly to persistence, credential theft, lateral movement, and data exfiltration. The workflow includes new accounts, web shells, legitimate RMM tools, **PowerShell**, **PsExec**, **Impacket**, **Mimikatz**, and **Rclone**. Security controls are interfered with before payload deployment, and **Medusa ransomware** can follow within 24 hours. The activity spans healthcare, education, professional services, and finance organizations across Australia, the United Kingdom, and the United States, but available evidence does not quantify total reach. Available guidance emphasizes rapid mitigation of exposed systems and hunting for web shells, RMM abuse, credential theft, and exfiltration artifacts.