Medusa Group

Medusa is a financially motivated ransomware operation active since 2021. Initially a closed operation, it transitioned to a ransomware-as-a-service model by early 2023, with developers supplying payloads and affiliates conducting intrusions. Also known as Medusa Blog and Medusa RaaS, the operation is distinct from MedusaLocker. Medusa has compromised more than 500 organizations, with extensive targeting of U.S. critical infrastructure. Frequently affected sectors include healthcare and public health, education, legal services, insurance, information technology, manufacturing, financial services, government services, and the defense industrial base. Healthcare has been a particularly frequent target. The operation purchases access through initial-access brokers, conducts credential phishing, and exploits exposed and unpatched public-facing applications, including rapidly weaponizing newly disclosed vulnerabilities. It uses credential dumping, native administrative utilities, PowerShell-based obfuscation, legitimate remote monitoring and management products, and remote desktop access for defense evasion, lateral movement, and post-compromise activity. Operators have also disabled security tooling, deleted shadow copies, stopped services, used remote-access tooling for persistence, and exfiltrated staged archives using commodity transfer utilities. Medusa employs double extortion: affiliates encrypt systems while threatening publication of stolen data through its leak site. It has also been reported to use additional pressure tactics consistent with triple extortion. Victims are commonly given a short period to begin negotiations, may be offered payment-related deadline extensions or discounts, and can be contacted directly to increase pressure.