Medusa Group

Medusa is a cybercrime ransomware group and ransomware-as-a-service (RaaS) operation first observed in 2021. The group is described as often using double extortion for monetary gain. Reported victim claims in the provided content include SimonMed Imaging, NASCAR, Insightin Health, and Pulse Urgent Care Center. Known aliases in the content include medusa, medusa_group, medusa_ransomware, and medusa_ransomware_group. The group’s observed tradecraft includes use of HTTPS for command and control, TOR nodes for communications, and reverse or bind shells over port 443. It has used Windows Command Prompt/cmd.exe to control and execute commands, including ingress, network, filesystem, and system enumeration, with examples such as "cmd.exe /c systeminfo". Medusa Group has used RDP for lateral movement and data exfiltration, including mstsc.exe with the format "mstsc.exe /v:{hostname/ip}". For discovery, it has leveraged RMM services and publicly available tools including Advanced IP Scanner and SoftPerfect Network Scanner for user, system, network, hostname, and network service discovery. For command and control and defense evasion, the content notes use of tunneling tools Ligolo and Cloudflared. Additional behaviors directly mentioned in the content include modifying Windows Registry keys to elevate privileges, maintain persistence, and allow remote access; deleting previously installed tools; exfiltrating data to cloud storage using Rclone; and utilizing a hard-coded security tool process list to identify and terminate processes via undocumented IOCTL code 0x222094.