Medusa Group

Medusa is a ransomware-as-a-service operation active since at least 2021. It is commonly tracked as Medusa, Medusa ransomware, Medusa Blog, and related affiliate or gang designations. The operation is financially motivated and uses double-extortion tactics, combining data theft with encryption and leak-site pressure. Medusa has targeted a broad range of organizations, including healthcare, industrial, and critical infrastructure entities. Reporting places it among the more frequently encountered ransomware actors in 2024–2025 incident response activity. Victimology is opportunistic and often driven by exposure of vulnerable public-facing services and remote management infrastructure rather than by a narrow regional focus. A defining characteristic of Medusa activity is aggressive exploitation of internet-exposed enterprise software for initial access. The group has been observed exploiting CVE-2023-48788 in FortiClient Enterprise Management Server and chaining CVE-2024-57727 with CVE-2024-57728 in SimpleHelp deployments to compromise management servers, obtain administrative access, and redirect managed agents under attacker control. In these intrusions, Medusa used the compromised remote-management layer to move laterally, establish persistence, exfiltrate data, and deploy ransomware. Medusa also abuses legitimate remote monitoring and management tools as part of its intrusion lifecycle. Observed tradecraft includes use of SimpleHelp and other remote access software for persistence and hands-on-keyboard operations. Post-compromise behavior has included credential theft, LSASS dumping, creation of local administrative accounts, lateral movement, data exfiltration, and staged ransomware deployment through enterprise administration tooling. The group’s defense-evasion tradecraft includes disabling or degrading endpoint security controls. Medusa-linked intrusions have featured use of EDR-killer tooling and bring-your-own-vulnerable-driver techniques, including commercial or shared tools seen across the ransomware ecosystem. Reporting also notes use of vulnerable or signed drivers to interfere with security products on victim systems. Technique reporting associated with Medusa includes PowerShell execution, exploitation for privilege escalation, Windows service creation or modification for persistence and installation, and proxying or anonymization for command and control. Like many mature ransomware affiliate ecosystems, Medusa appears to combine bespoke intrusion steps with commodity administrative tools and shared underground tooling. Known aliases include Medusa, Medusa ransomware, Medusa Blog, Medusa ransomware gang, Medusa ransomware group, Medusa affiliates, and related naming variants. Available reporting supports characterization of Medusa as a criminal ransomware enterprise rather than a nation-state actor.