Medusa Group

Medusa, also known as Medusa Ransomware, the Medusa ransomware group, and Medusa ransomware gang, is a financially motivated cybercriminal operation first identified in 2021 that became substantially more active in 2023. It operates a ransomware-as-a-service platform, supplying affiliates with malware and infrastructure under a profit-sharing arrangement. Medusa is distinct from MedusaLocker and other unrelated malware using the Medusa name. Its geographic origin has not been established with high confidence. Medusa opportunistically targets organizations worldwide, with a pronounced concentration in the United States. Victims include healthcare providers, manufacturers, educational institutions, government organizations, technology companies, financial and insurance businesses, retailers, and professional-services firms. Its operators use double extortion: stealing sensitive information before encrypting systems and threatening public disclosure. Tor-hosted negotiation portals and a dedicated leak site support ransom negotiations, victim listings, disclosure countdowns, and publication of stolen material. Telegram and other public channels amplify its extortion campaigns. Initial access methods include phishing, exploitation of vulnerable internet-facing systems, compromised VPN and administrative accounts, and access purchased from initial access brokers. Medusa activity includes exploitation of CVE-2023-48788 in FortiClient EMS. Affiliates extensively employ living-off-the-land techniques and legitimate remote-management software, including AnyDesk, ConnectWise, SimpleHelp, and PDQ Deploy, to maintain access, evade detection, and distribute payloads. Intrusions involve network scanning, domain reconnaissance, LSASS and Active Directory credential dumping, and lateral movement through RDP, SMB administrative shares, PsExec, and WMI. PowerShell and native Windows utilities support execution, persistence, data staging, and exfiltration to cloud storage. Before deploying its Windows ransomware, Medusa disables endpoint protection, interferes with backup services, and deletes volume shadow copies to impede recovery. Its defense-evasion tooling includes vulnerable-driver abuse and EDR-disabling tools such as AuKill and EDRKillShifter. Stolen-data disclosure remains an extortion lever even when victims can restore encrypted systems from backups.