Overview
Medusa is a double-extortion ransomware-as-a-service operation that emerged in late 2022 and should not be confused with MedusaLocker, a separate and unrelated threat group. By 2025, Medusa had established itself among the top ten most prolific ransomware operations by victim count, with CISA and the FBI issuing a joint advisory in February 2025 documenting over 300 known victims across critical infrastructure sectors. Victim counts continued to grow through 2026, with healthcare, education, and government accounting for the largest share of publicly claimed attacks.
The group operates a dedicated leak site at a .onion domain (medusablog), where victim data is posted and a countdown timer applies pressure to pay. Victims are offered a direct negotiation channel and can pay to extend the timer or delete their data before it is published.
Background and Attribution
Medusa appears to operate as a closed affiliate model, recruiting a small number of vetted affiliates rather than the open affiliate marketplaces used by LockBit or RansomHub. CISA’s advisory noted that Medusa actors are known to recruit through criminal forums and that initial access brokers (IABs) play a role in providing entry points to targets that the core team then develops.
Attribution to a specific national nexus has not been confirmed publicly. Operational security practices — use of TOR infrastructure, cryptocurrency payment processing, avoidance of Russian-language targets — are consistent with financially motivated actors seeking to reduce law enforcement attention, but no definitive link to a state has been established.
The February 2025 CISA/FBI/MS-ISAC advisory is the most authoritative public source on Medusa’s TTPs to date.
Initial Access
Medusa’s most consistently documented initial access technique is exploitation of internet-facing applications with unpatched vulnerabilities, combined with abuse of legitimate remote access tools:
Vulnerability exploitation: Medusa actors have been documented exploiting vulnerabilities in Citrix NetScaler (CVE-2023-4966 “CitrixBleed”), Fortinet FortiOS (CVE-2023-27997), and Microsoft Exchange Server. This pattern of targeting perimeter appliance vulnerabilities for initial access is consistent with numerous other ransomware groups and reflects the high availability of initial access via unpatched remote access infrastructure.
Compromised RDP and remote access: Valid credentials purchased from IABs or obtained via phishing or credential stuffing are used to authenticate to VPN portals, RDP, and RMM tools without exploiting a vulnerability. This path is particularly common in smaller targets where perimeter security is weaker.
Phishing with malicious attachments: Less common but documented, particularly as the second stage of a broader social engineering campaign.
Post-Compromise Behaviour and TTPs
Once inside, Medusa actors follow a methodical reconnaissance and escalation pattern consistent with an experienced, patient operation:
Living off the land: Medusa operators prefer legitimate system tools over custom malware during the exploitation phase — PowerShell, WMI, PsExec, RDP, and standard Windows administration utilities. This slows attribution and reduces EDR detection rates.
Credential harvesting: Mimikatz variants and tools targeting the Windows SAM database, NTDS.dit, and LSA secrets. The group targets Active Directory specifically to obtain domain admin credentials before moving to mass deployment.
Lateral movement: PsExec for remote execution, SMB for file system access, WMI for persistent task scheduling, and RDP for interactive access to high-value systems.
Defence evasion: Documented use of Bring Your Own Vulnerable Driver (BYOVD) techniques to disable or bypass endpoint detection and response products before deploying ransomware. This technique — disabling security software via a signed but vulnerable driver — is now standard practice for several ransomware groups including Medusa.
Data exfiltration before encryption: Medusa exfiltrates data prior to encryption for double-extortion leverage. Rclone is a commonly observed exfiltration tool, syncing victim data to cloud storage or SFTP servers under attacker control before encryption begins.
Ransomware deployment: Final stage is mass deployment of the encryptor across the domain using domain admin credentials and Group Policy or PsExec for distribution. The encryptor targets Windows file systems, and separate Linux/ESXi variants have been documented for targeting virtualisation infrastructure.
Extortion Model
Medusa operates a tiered extortion model with several payment options presented on the negotiation portal:
- Pay the ransom to receive a decryption key
- Pay to delete data before it is published on the leak site (without decryption)
- Pay to extend the timer (typically $10,000 USD) to buy negotiation time
Ransom demands from Medusa have ranged from low six figures for smaller organisations to multiple millions for large healthcare and government entities. Payment is demanded in Bitcoin or Monero.
Data published on Medusa’s leak site is typically provided in two forms: a proof-of-exfiltration dump (sample files to demonstrate possession) and the full dataset after the timer expires. The group has generally followed through on data publication for victims that don’t pay, making the double-extortion threat credible.
Healthcare Sector Targeting
Healthcare is one of Medusa’s most heavily targeted sectors, consistent with a broader pattern among ransomware groups that view clinical operations dependency on data as creating pressure to pay. Medusa-attributed incidents affecting hospitals, health systems, and clinical service providers have been documented across the US, UK, Australia, and Canada.
The operational impact of Medusa attacks on healthcare has included:
- Cancellation of elective procedures and scheduled appointments
- Diversion of ambulances during the acute phase
- Loss of access to electronic patient records requiring paper-based fallback
- Exposure of patient data including PHI, insurance records, and clinical notes
In the US, Medusa attacks on covered healthcare entities trigger HIPAA breach notification obligations in addition to any ransom payment considerations. Under the 2024 HHS guidance on cybersecurity expectations for healthcare, boards at healthcare entities that suffer ransomware attacks are subject to scrutiny over pre-incident security investment decisions.
Defensive Recommendations
CISA’s February 2025 advisory provides the authoritative defensive guidance, which centres on:
Patch internet-facing systems promptly: Medusa’s initial access frequently exploits known vulnerabilities in VPN, remote access, and mail server products within weeks of public disclosure. A rapid patching programme for internet-facing infrastructure — measured in days, not the standard 30-day window — materially reduces the initial access risk.
MFA on all remote access: RDP, VPN, and RMM tools without MFA are the primary path for IAB-sourced credential abuse. Without MFA, stolen credentials provide direct access.
Restrict use of RMM tools: If PsExec, remote management software, and similar tools aren’t needed in a network environment, disable or remove them. Where needed, restrict to approved tools and monitor for unexpected usage.
Segment domain admin accounts: Medusa’s lateral movement path runs through domain administrator credentials. Tiered administration — where accounts with domain admin rights are never used interactively on workstations or servers where credential theft is likely — limits the blast radius of a compromised regular admin account.
Air-gapped and offsite backups: Medusa operators target backup systems in the network before deploying ransomware. Backups that are accessible from compromised administrator accounts are likely to be encrypted or deleted. Offline, offsite, or immutable backup storage is the operational recovery path when ransomware deploys successfully.
Current Status (2026)
As of mid-2026, Medusa remains an active operation with regular victim postings on its leak site. No law enforcement disruption or infrastructure seizure affecting Medusa operations has been publicly announced. The group continues to target primarily English-speaking markets — US, UK, Australia, Canada — and shows no signs of the internal dysfunction or exit-scam behaviour that took down ALPHV/BlackCat in early 2024.
The CISA/FBI advisory from February 2025 remains the primary reference for incident responders encountering a suspected Medusa intrusion.