Loading story…
A Medusa ransomware attack at an unnamed US organization in March 2024 involved suspicious activity across more than 80 devices, including an internet-facing domain controller. Attackers used administrative credentials, legitimate utilities and living-off-the-land techniques for reconnaissance and lateral movement, including network scanning and SMB transfers. Files were encrypted with .s3db and .MEDUSA extensions, and a Medusa ransom note was dropped. Connections to legitimate remote-management services were assessed as likely supporting data exfiltration, although that assessment does not establish confirmed data theft.
Darktrace detected and correlated the activity, but autonomous blocking was not enabled, leaving mitigation dependent on manual approval. Separate Unit 42 reporting highlighted Medusa’s escalation and a new leak site. The incident underscores the importance of restricting internet exposure of domain controllers, protecting privileged credentials, monitoring unusual SMB and remote-management activity, and ensuring high-confidence ransomware detections trigger a tested, timely containment process.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
On March 7, the internet-facing server transferred suspicious files to multiple internal devices over SMB, targeting ADMIN$ and IPC$ shares. Attackers also wrote SQLite3 DLL files that Darktrace assessed as likely containing a payload associated with subsequent encryption.
During encryption, the attackers established SSL connections to services.pdq[.]tools, teamviewer[.]com, and anydesk[.]com. Darktrace assessed these connections as highly likely to represent attempted data exfiltration for extortion, but did not independently confirm what data was transferred.
The attackers subsequently encrypted files with the .MEDUSA extension and dropped the ransom note !!!Read_me_Medusa!!!.txt. Darktrace also observed file deletion during the attack, including deletion of files bearing the .MEDUSA extension.
During the March 2024 attack, the attackers used credentials previously observed on the network to encrypt files with the .s3db extension. Darktrace linked this activity to the suspected payload in the SQLite3 DLL files.
A few hours after scanning began on March 1, administrative connections formed a lateral-movement chain across multiple devices, including the internet-facing server. Darktrace identified three hops and linked the chain to a device involved in the earlier scanning.
Between March 1 and March 7, two devices attempted internal connections consistent with network scanning, including a request identified as evidence of Nmap use. The svc-ndscans credential was associated with DCE-RPC activity on March 1.
Darktrace identified suspicious activity at an unnamed US organization, including an internet-facing domain controller and unusual HTTP connections using PowerShell and JWrapperDownloader user agents. It correlated the activity into one investigation; autonomous blocking was not enabled, so mitigation required customer approval.
Medusa ransomware was first observed in the wild toward the end of 2022, according to Darktrace. It is distinct from MedusaLocker.
Darktrace analysts assisted the affected organization with incident triage and investigation through its Ask the Expert service.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Medusa has expanded into a global ransomware-as-a-service operation combining data theft, Windows encryption, and public pressure on victims. First observed in 2021 and distinct from MedusaLocker and Medusa Stealer, the operation accelerated in 2023, targeting organizations across multiple industries, particularly in the United States. Bitdefender reported 145 victims in 2023, while later reporting cited more than 500 cumulative victims; its projection of over 200 victims for 2024 was a forecast, not a confirmed total. Medusa uses Tor negotiation portals, leak-site countdowns, and Telegram publicity, with reported payment options to delay disclosure, purchase stolen information, or request deletion. Reports link its publicity operations to OSINT Without Borders, although ownership remains unconfirmed. Reported disruptions—including Dark Atlas removing victim information from a cloud account in 2024 and a subsequent U.S. Justice Department seizure of the associated OSINTCORP website—did not end Medusa’s operations. Affiliates reportedly enter networks through phishing, stolen credentials, exposed infrastructure, and vulnerabilities including FortiClient EMS **CVE-2023-48788**, Citrix Bleed **CVE-2023-4966**, and ConnectWise ScreenConnect **CVE-2024-1709**. Attack chains involve credential theft, remote-management tools, lateral movement, exfiltration, and disabling security and backup services, including through vulnerable drivers. A September 2026 intelligence brief cautions that its broader 19-CVE inventory is not a confirmed exploitation list. Defensive priorities are rapid patching of internet-facing systems, phishing-resistant MFA, reduced remote-access exposure, monitoring for credential theft and exfiltration, isolated backups, and rehearsed incident response. **Restoring backups addresses availability, but does not remove the confidentiality or extortion risks posed by stolen data.**
Oct 9, 2026
CISA, the FBI, and HHS issued an updated joint advisory warning that **Medusa ransomware** operators have compromised more than **500 organizations** as of April 2026, with heavy targeting of **critical infrastructure** and especially **healthcare and public health** entities. The agencies said the group evolved from a closed operation into a **ransomware-as-a-service** model in 2023, using double extortion by stealing data before encrypting systems. Officials said Medusa actors can exploit newly disclosed vulnerabilities within 24 hours, and in some cases were observed abusing flaws up to a week before public disclosure. The advisory said Medusa gains access through **initial access brokers**, reportedly offering up to **$1 million** for exclusive access, and has exploited vulnerabilities including `CVE-2024-1709`, `CVE-2023-48788`, GoAnywhere MFT flaws, and `CVE-2026-1731`. Once inside, operators use living-off-the-land techniques, credential dumping, stolen or vulnerable drivers, and legitimate remote monitoring and management tools to disable security controls, move laterally, steal sensitive data, and encrypt networks. Authorities also described aggressive extortion tactics such as rapid-payment discounts and paid deadline extensions, while urging organizations to patch quickly, segment networks, enforce phishing-resistant MFA, maintain offline immutable backups, and monitor for unauthorized RMM activity.
Aug 20, 2026
Medusa ransomware encrypted hosts in an unmonitored subdomain of a North American organization in an incident investigated by ReliaQuest in June 2024. The suspected intrusion began in early April through a compromised customer VPN account, followed by network discovery and credential dumping from LSASS and Active Directory. Attackers subsequently used compromised administrative credentials for RDP lateral movement, installed remote-access tools, and abused PDQ tooling to deploy ransomware. A suspected vulnerable driver apparently helped bypass endpoint protection. Fragmented domains, legacy systems, and visibility gaps complicated investigation and response. ReliaQuest recommended stronger VPN authentication, network segmentation, comprehensive endpoint monitoring, least privilege, and tested recovery plans. Microsoft's additional LSA protection guidance and Credential Guard documentation provide complementary credential-hardening measures. Credential Guard uses virtualization-based security to isolate NTLM hashes, Kerberos ticket-granting tickets, and certain stored domain credentials, helping mitigate pass-the-hash and pass-the-ticket attacks even when malware has administrative privileges. It does not stop all persistent threat activity or replace detection and containment controls. Deployment requires hardware, licensing, and application compatibility checks; Microsoft does not recommend or support enabling Credential Guard on domain controllers or Exchange Server.
Oct 9, 2026