Loading malware…
Medusa is a financially motivated Windows ransomware family and ransomware-as-a-service operation first identified in 2021. It is distinct from MedusaLocker, Medusa Android malware, and unrelated tools sharing the Medusa name. Its affiliates conduct double-extortion attacks, stealing sensitive information before encrypting systems and threatening public disclosure. Victims span multiple countries and industries, including healthcare, education, manufacturing, finance, government, technology, and professional services, with substantial targeting of United States organizations.
Medusa intrusions use phishing and spearphishing, compromised accounts, access purchased from initial access brokers, and exploitation of vulnerable internet-facing systems. Operations have exploited CVE-2023-48788 in FortiClient EMS. Microsoft-tracked Storm-1175, an actor associated with Medusa ransomware operations, has also exploited CVE-2025-10035 in GoAnywhere MFT. Affiliates abuse legitimate remote-management software, including ConnectWise, AnyDesk, SimpleHelp, and PDQ products, to maintain access, blend into administrative activity, and deploy payloads.
Post-compromise activity includes network discovery, credential dumping from LSASS and Active Directory, PowerShell execution, and lateral movement through RDP, SMB, WMI, and PsExec. Operators exfiltrate data to external storage, establish persistence through remote-management tools and Windows startup mechanisms, and impair endpoint protection. Medusa attacks have used vulnerable drivers and the AuKill security-disabling tool to bypass endpoint defenses. Before or during encryption, attackers terminate security and backup services and delete volume shadow copies to hinder recovery. The ransomware encrypts victim files and deposits ransom instructions. The operation applies further pressure through public data-leak sites, countdowns, Tor-based negotiation portals, and messaging channels that publicize stolen information.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
20 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Medusa gains access to a target system through a known weakness such as the Fortinet EMS SQL injection vulnerability. CVE-2023-48788 impacts environments that have FortiClient EMS, versions 7.2 to 7.2.2 and 7.0.1 to 7.0.10, installed to manage endpoints.
Reporting associates activity with CVE-2024-1709 (ConnectWise ScreenConnect auth bypass). Exposure and patch status should be validated before treating it as confirmed Medusa exploitation.
CVE-2023-4966: CitrixBleed (August to October 2023) ... The above-mentioned CVEs are confirmed to be exploited by Medusa Group from various security incident reports.
Group Member “nopiro” had used CVE-2022–26134 Exploit (Confluence ONGL Injection) for Medusa Ransomware Operations. | The leak consists of Chat Transcript between group members from December 11 2022 to March 2023.
Deux nouveaux CVE exploités : ... CVE-2026-1731 : injection de commandes OS dans BeyondTrust (CWE-78) ... Weaponisation en moins de 24h après annonce publique d’un CVE, parfois jusqu’à une semaine avant la divulgation publique | Medusa est une opération ransomware-as-a-service (RaaS) active depuis juin 2021, ayant impacté plus de 500 organisations d’infrastructure critique...
Deux nouveaux CVE exploités : CVE-2025-10035 : désérialisation de données non fiables dans Fortra GoAnywhere (CWE-502) ... Weaponisation en moins de 24h après annonce publique d’un CVE, parfois jusqu’à une semaine avant la divulgation publique | Medusa est une opération ransomware-as-a-service (RaaS) active depuis juin 2021, ayant impacté plus de 500 organisations d’infrastructure critique...
In the recent campaign, according to Microsoft, the group may be exploiting CVE-2026-18577 - a flaw in the N-central, a remote monitoring and management (RMM) console used by various service providers to supervise client endpoints. The flaw allows threat actors “unauthenticated, ‘god-mode’ access,” warned cybersecurity firm Huntress.
Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws in Mirth Connect (CVE-2023-37679, CVE-2023-43208). | The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware... Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws...
Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws in JetBrains TeamCity (CVE-2024-27198, CVE-2024-27199). | The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware... Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws...
Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws in ConnectWise ScreenConnect (CVE-2024-1709, CVE-2024-1708). | The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware... Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws...
Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws in JetBrains TeamCity (CVE-2024-27198, CVE-2024-27199). | The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware... Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws...
Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws in Mirth Connect (CVE-2023-37679, CVE-2023-43208). | The use of StormEncryptor marks a shift from the adversary's previous use of Medusa ransomware... Storm-1175 is the name assigned to a China-based threat actor with a history of deploying Medusa ransomware after exploiting security flaws...
CVE-2024-57728 (CVSS: 7.2): This vulnerability permits admin users to upload arbitrary files anywhere on the SimpleHelp file system by exploiting a crafted zip file, known as a zip slip. This could lead to arbitrary code execution on the host system in the context of the SimpleHelp server user. | Since 6 February 2025, S-RM has responded to several incidents involving the ransomware group Medusa, where this group has exploited SimpleHelp vulnerabilities to gain initial access to victims’ infrastructure.
CVE-2024-57727 (CVSS: 7.5): This flaw involves multiple path traversal vulnerabilities, permitting unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. | Since 6 February 2025, S-RM has responded to several incidents involving the ransomware group Medusa, where this group has exploited SimpleHelp vulnerabilities to gain initial access to victims’ infrastructure.
In the first quarter of 2025, Medusa ransomware operators launched a wave of coordinated attacks against UK organisations through compromised MSPs. | The campaigns, uncovered in early 2025, leveraged a trio of flaws—CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728—to pivot from compromised RMM servers into victim networks with “minimal friction.”
This method was observed in high-tempo operations linked to Medusa affiliates (Storm-1175) and has been adopted by multiple groups deploying Akira and Black Basta payloads.
...the Microsoft Exchange Server deserialization of untrusted data bug, tracked as CVE-2023-21529, was included to the CISA list after being leveraged by Chinese financially motivated threat operation Storm-1175 to spread the Medusa ransomware. | the Microsoft Exchange Server deserialization of untrusted data bug, tracked as CVE-2023-21529, was included to the CISA list after being leveraged by Chinese financially motivated threat operation Storm-1175 to spread the Medusa ransomware.
The flaw in question is CVE-2023-0669, an SQL injection vulnerability that allows remote code execution without authentication. Discovered in February 2023, Fortra released an immediate patch, but attackers continue to exploit it months later. Medusa, an emerging ransomware-as-a-service (RaaS) group... | Medusa, an emerging ransomware-as-a-service (RaaS) group, has been targeting vulnerable Fortra's GoAnywhere MFT systems... Medusa scans the internet for exposed GoAnywhere servers, injecting malicious payloads to encrypt and exfiltrate data.
A notorious group of hackers is currently causing major disruption globally by deploying the devastating Medusa ransomware. | This pace was clear during a recent attack on a SAP NetWeaver system (tracked as CVE-2025-31324). The flaw was announced on April 24, 2025, and by April 25, the group was already using it to launch Medusa ransomware operations.
Storm-1175 actors are running up-tempo campaigns to deliver Medusa ransomware... Attackers move quickly from vulnerability exploitation to data exfiltration and, finally, delivery of Medusa ransomware, often within a few days and, in some cases, within 24 hours. | Other notable flaws exploited by Storm-1175 include CVE-2025-31161, a critical authentication bypass vulnerability in CrushFTP's file transfer software that also sparked a public disclosure dispute last spring.
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Other observed tooling included Medusa-related components, custom SSH backdoors and packet-triggered backdoors.
After that, Darktrace observed the attacker encrypting files and appending them with the extension “.MEDUSA” while also dropping a ransom note with the file name “!!!Read_me_Medusa!!!.txt”
Storm-1175 (tracked by Microsoft Threat Intelligence) is actively exploiting this vulnerability. The group is associated with Medusa ransomware operations and is known for targeting public-facing applications for initial access.
Droppers using the same instal*tvtap*.apk naming convention were previously identified as distributing Medusa banking trojan samples, attributed by Cleafy in 2024 to the UNKN affiliate botnet.
Medusa is a ransomware-as-a-service platform that has operated since June 2021 and targets critical infrastructure.
In recent months, the Lazarus Group and its related intrusion set Moonstone Sleet have also been attributed to attacks targeting South Korean and Middle East entities with Qilin and Medusa ransomware.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
185 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Medusa-related components were observed in Fire Ant's infrastructure-compromise activity. The indicator table identifies a Medusa rootkit binary, although the same SHA1 is also labeled as a custom SSH backdoor. The advisory does not provide further Medusa-specific functionality or identify it as ransomware.
Ransomware mentioned as background context for prior attacks involving SimpleHelp. No ransomware-specific behavior or distribution details are provided.
Le loader inclut des restrictions de ciblage (pas de pays CIS, pas de secteur public), pratique courante dans les malwares du nexus russe (LockBit, Qilin, Cl0p, Medusa).
Mentioned as an example of Russia- or CIS-associated ransomware using CIS-targeting exclusion checks; no operational association with Sauron Loader is established.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.