Loading threat actor…
Medusa, also known as Medusa ransomware and MedusaBlog, is a financially motivated cybercriminal operation active since 2021 that expanded substantially in 2023. It operates a ransomware-as-a-service program, supplying affiliates with ransomware and supporting infrastructure in exchange for a share of ransom payments. Medusa is distinct from MedusaLocker and similarly named information-stealing malware. The operation targets organizations worldwide, with a pronounced concentration in the United States. Victims span healthcare, manufacturing, education, government, financial services, technology, retail, and professional services. Its targeting is opportunistic, exploiting vulnerable infrastructure and weak access controls rather than serving an established geopolitical objective. Its operators' country of origin has not been established with high confidence. Medusa affiliates obtain initial access through phishing, exploitation of internet-facing applications and appliances, compromised accounts, and access purchased from initial access brokers. Documented activity includes exploitation of CVE-2023-48788 in FortiClient EMS. Intrusions extensively employ living-off-the-land techniques and legitimate remote-management software, including AnyDesk, ConnectWise, SimpleHelp, and PDQ tools, to maintain access and blend into administrative activity. Post-compromise behavior includes network scanning, account and system discovery, credential extraction from LSASS and Active Directory, and lateral movement through RDP, SMB administrative shares, WMI, and PsExec. Attackers use PowerShell and administrative utilities for execution and persistence. They disable endpoint protection, including through bring-your-own-vulnerable-driver tools such as AuKill, and interfere with backups and volume shadow copies before deploying Windows ransomware. Medusa uses double extortion, combining data theft and encryption with threats to publish stolen information. It operates public-facing data-leak and negotiation infrastructure, uses countdowns to pressure victims, and publicizes stolen data through Telegram and other media channels. Its affiliate program has advertised substantial revenue shares, round-the-clock support, and dedicated administration, media, and negotiation teams.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
63 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
12 malware families attributed to this actor across reporting.
7 additional families tracked in Mallory.
17 CVEs this actor has used in observed campaigns. 17 of them exploited in the wild.
Some of the vulnerabilities exploited are:- CVE-2023-48788: SQL Injection Vulnerability in FortiClient Enterprise Management Server ... The above-mentioned CVEs are confirmed to be exploited by Medusa Group from various security incident reports.
Initial Access : Phishing [T1566], exploitation d’applications publiques [T1190] CVEs : CVE-2024-1709 (ScreenConnect), CVE-2023-48788 (Fortinet EMS), CVE-2025-10035, CVE-2026-1731
Deux nouveaux CVE exploités : CVE-2025-10035 : désérialisation de données non fiables dans Fortra GoAnywhere (CWE-502) ... Weaponisation en moins de 24h après annonce publique d’un CVE, parfois jusqu’à une semaine avant la divulgation publique
Group Member “nopiro” had used CVE-2022–26134 Exploit (Confluence ONGL Injection) for Medusa Ransomware Operations.
CVE-2024-57727 (CVSS: 7.5): This flaw involves multiple path traversal vulnerabilities, permitting unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests.
12 more CVEs tied to this actor tracked in Mallory.
124 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a historical comparison involving a claimed attack on Summit Pathology Labs and the compromise of information belonging to 1.8 million people. The content does not connect Medusa to the Ampath incident.
Mentioned as a historical comparison: the ransomware gang claimed an attack against U.S.-based Summit Pathology Labs in 2024, an incident that compromised information belonging to 1.8 million people. No specific malware payload, exploited vulnerability or attack method is identified in the primary text.
Referenced as a comparative example of Russia- or CIS-nexus criminal malware with CIS-targeting exclusions.
Mentioned solely as a comparison to explain the potential impact of ransomware-related data-leak threats.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.