Loading story…
Medusa ransomware encrypted hosts in an unmonitored subdomain of a North American organization in an incident investigated by ReliaQuest in June 2024. The suspected intrusion began in early April through a compromised customer VPN account, followed by network discovery and credential dumping from LSASS and Active Directory. Attackers subsequently used compromised administrative credentials for RDP lateral movement, installed remote-access tools, and abused PDQ tooling to deploy ransomware. A suspected vulnerable driver apparently helped bypass endpoint protection. Fragmented domains, legacy systems, and visibility gaps complicated investigation and response.
ReliaQuest recommended stronger VPN authentication, network segmentation, comprehensive endpoint monitoring, least privilege, and tested recovery plans. Microsoft's additional LSA protection guidance and Credential Guard documentation provide complementary credential-hardening measures. Credential Guard uses virtualization-based security to isolate NTLM hashes, Kerberos ticket-granting tickets, and certain stored domain credentials, helping mitigate pass-the-hash and pass-the-ticket attacks even when malware has administrative privileges. It does not stop all persistent threat activity or replace detection and containment controls. Deployment requires hardware, licensing, and application compatibility checks; Microsoft does not recommend or support enabling Credential Guard on domain controllers or Exchange Server.
TTPs, infrastructure, and targeting history in one profile.
14 events from the most recent confirmed update back to the earliest known activity.
ReliaQuest responded in June 2024 to EDR detections associated with the attack. Fragmented domains, legacy systems, and gaps in endpoint visibility impeded the investigation and response.
Successful encryptor deployment followed the suspected driver activity, encrypting multiple hosts in the North American organization's unmonitored subdomain. The ransom note !!!READ_ME_MEDUSA!!!.txt was written to affected hosts.
Investigators subsequently detected C:\WINDOWS\TEMP\igJTf.sys. ReliaQuest assessed it as a vulnerable driver likely intended for kernel-level installation to unhook antivirus protection.
Within an hour of the PDQ Inventory installations, investigators observed PDQDeploy logons and antivirus detections that blocked gaze.exe. The executable carried a Medusa-related signature.
On the same day as the AnyDesk installation, the attacker used a compromised administrative account to install the PDQInventory-Scanner-1 service on multiple hosts.
The attacker installed AnyDesk on a target server within minutes of the observed RDP connection. ReliaQuest assessed the installation as redundant command-and-control access intended to maintain the foothold before encryption.
At the beginning of June, investigators confirmed RDP lateral movement through type 10 logons using a compromised administrative account. A connection originated from a domain controller and used a same-named account from another domain.
Exported Windows System logs showed SimpleHelp remote-monitoring-and-management service installations on a target host dating back to mid-May.
In May, the attacker used lsassy to locate LSASS and invoke comsvcs.dll through rundll32.exe to dump in-memory credentials.
Within a day of the first VPN session, investigators identified an LSASS-dumping attempt from a VPN-assigned address and an NTDS-dumping attempt on a domain controller. The latter used PowerShell and ntdsutil to create an Active Directory database snapshot and copy registry hives for password-hash extraction.
Within an hour of the initial VPN session, firewall traffic from the assigned internal address resembled port scanning against multiple destinations. The activity continued for several hours.
Investigators identified an anomalous VPN session in early April 2024 using a customer domain account from Russian IP address 178.208.87.250. The session received an address in a legacy customer-access subnet; investigators could not determine how the credentials were obtained.
Medusa introduced its data leak site in early 2023 to publish information about its victims.
Security researchers first identified Medusa as a ransomware-as-a-service operator in late 2022. The report distinguishes it from the separate MedusaLocker ransomware operation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Medusa ransomware attack at an unnamed US organization in March 2024 involved suspicious activity across more than 80 devices, including an internet-facing domain controller. Attackers used administrative credentials, legitimate utilities and living-off-the-land techniques for reconnaissance and lateral movement, including network scanning and SMB transfers. Files were encrypted with `.s3db` and `.MEDUSA` extensions, and a Medusa ransom note was dropped. Connections to legitimate remote-management services were assessed as likely supporting data exfiltration, although that assessment does not establish confirmed data theft. Darktrace detected and correlated the activity, but autonomous blocking was not enabled, leaving mitigation dependent on manual approval. Separate Unit 42 reporting highlighted Medusa’s escalation and a new leak site. The incident underscores the importance of restricting internet exposure of domain controllers, protecting privileged credentials, monitoring unusual SMB and remote-management activity, and ensuring high-confidence ransomware detections trigger a tested, timely containment process.
Oct 9, 2026
Medusa has expanded into a global ransomware-as-a-service operation combining data theft, Windows encryption, and public pressure on victims. First observed in 2021 and distinct from MedusaLocker and Medusa Stealer, the operation accelerated in 2023, targeting organizations across multiple industries, particularly in the United States. Bitdefender reported 145 victims in 2023, while later reporting cited more than 500 cumulative victims; its projection of over 200 victims for 2024 was a forecast, not a confirmed total. Medusa uses Tor negotiation portals, leak-site countdowns, and Telegram publicity, with reported payment options to delay disclosure, purchase stolen information, or request deletion. Reports link its publicity operations to OSINT Without Borders, although ownership remains unconfirmed. Reported disruptions—including Dark Atlas removing victim information from a cloud account in 2024 and a subsequent U.S. Justice Department seizure of the associated OSINTCORP website—did not end Medusa’s operations. Affiliates reportedly enter networks through phishing, stolen credentials, exposed infrastructure, and vulnerabilities including FortiClient EMS **CVE-2023-48788**, Citrix Bleed **CVE-2023-4966**, and ConnectWise ScreenConnect **CVE-2024-1709**. Attack chains involve credential theft, remote-management tools, lateral movement, exfiltration, and disabling security and backup services, including through vulnerable drivers. A September 2026 intelligence brief cautions that its broader 19-CVE inventory is not a confirmed exploitation list. Defensive priorities are rapid patching of internet-facing systems, phishing-resistant MFA, reduced remote-access exposure, monitoring for credential theft and exfiltration, isolated backups, and rehearsed incident response. **Restoring backups addresses availability, but does not remove the confidentiality or extortion risks posed by stolen data.**
Oct 9, 2026
Microsoft said threat actor **Storm-1175** is running high-tempo intrusions that exploit newly disclosed and, in some cases, previously unknown vulnerabilities in internet-facing systems to steal data and deploy **Medusa ransomware** within days or even 24 hours. The financially motivated group has heavily impacted healthcare organizations and also targeted education, professional services, and finance in Australia, the United Kingdom, and the United States. Since 2023, the actor has exploited more than 16 flaws across products including **Microsoft Exchange**, **PaperCut**, **Ivanti**, **ConnectWise ScreenConnect**, **JetBrains TeamCity**, **SimpleHelp**, **CrushFTP**, **GoAnywhere MFT**, **SmarterMail**, **SAP NetWeaver**, and **BeyondTrust**, with Microsoft also observing zero-day use against SmarterMail and GoAnywhere before public disclosure. After gaining access, Storm-1175 establishes persistence with new administrator accounts, web shells, and remote management tools, then moves laterally using LOLBins, **Impacket**, **PDQ Deployer**, and Cloudflare tunnels while stealing credentials from **LSASS**, `NTDS.dit`, `SAM`, and backup systems. Microsoft said the actor tampers with Microsoft Defender settings to reduce detection, uses **Bandizip** and **Rclone** for collection and exfiltration, and deploys Medusa through PDQ Deployer or Group Policy; the group has also shown interest in Linux targets such as vulnerable **Oracle WebLogic** servers. Microsoft urged organizations to reduce exposure of web-facing assets, patch quickly, enforce MFA on approved RMM tools, restrict local administrator rights, and enable protections such as **Credential Guard**, tamper protection, and Defender XDR attack disruption features.
Aug 18, 2026