Medusa

Medusa is a financially motivated ransomware-as-a-service operation first identified in 2021 that has targeted hundreds of organizations across healthcare, education, legal, insurance, technology, manufacturing, and other critical sectors. It operates a double-extortion model in which operators or affiliates steal data before encrypting systems and then threaten public disclosure through a leak site if victims do not pay. Medusa began as a closed operation and later adopted an affiliate model, while core operators reportedly retained centralized control over negotiations.

Medusa commonly gains initial access through purchased footholds from initial access brokers, credential-phishing, and exploitation of vulnerable internet-facing services. Public reporting has linked the group to exploitation of ScreenConnect CVE-2024-1709, FortiClient EMS CVE-2023-48788, and SimpleHelp vulnerabilities including CVE-2024-57727 and CVE-2024-57728. In observed intrusions, operators used compromised remote-management infrastructure to hijack agents, redirect management traffic, and establish persistent access.

Post-compromise activity includes use of PowerShell, WMI, RDP, PsExec, Cobalt Strike, built-in Windows tooling, and commercial or legitimate remote-management software for execution, discovery, lateral movement, and staging. Medusa operators have also used network-scanning utilities and deployment tools to expand access across victim environments. Data theft commonly precedes encryption, with exfiltration frequently conducted using Rclone.

A notable feature of Medusa tradecraft is aggressive defense evasion. The operation has been associated with bring-your-own-vulnerable-driver techniques to disable or impair endpoint security products, including use of the ABYSSWORKER kernel driver in campaigns where a packed loader deployed the driver before ransomware execution. Reported behavior also includes terminating services, deleting shadow copies, and clearing PowerShell command history to hinder response and recovery.

On Windows systems, Medusa encrypts files and appends a characteristic extension, then drops a ransom note directing victims to negotiation channels. The operation is distinct from similarly named threats such as MedusaLocker, the Android banking trojan called Medusa, the Mythic agent named Medusa, and the open-source Linux rootkit of the same name.