Uncover gaps in your Microsoft Identity Security.
Book an identity exposure gap analysis today.
Threat actors
>
Ransomware Group

Medusa

Medusa ransomware is a sophisticated cyber threat known for its rapid encryption capabilities and unique deployment techniques, primarily targeting organizations across various sectors with the aim of extorting ransom payments.

Detect Medusa's TTPs
Is Your Organization Safe from Medusa Ransomware's Attacks?
Background
Targets
TTPs
Detection
FAQs

The origin of Medusa ransomware

Medusa or MedusaBlog is a sophisticated ransomware group that has been actively targeting organizations since at least early 2023. The group has gained notoriety for its rapid encryption capabilities and unique techniques for spreading its malware and seems to be related to MedusaLocker. The name "Medusa" reflects the group's tendency to metaphorically "turn files to stone," rendering them unusable until a ransom is paid.

Source: Unit42 and OCD

The origin of Medusa ransomware
Targets

Medusa's targets

Countries targeted by Medusa ransomware

The majority of Medusa's attacks have been concentrated in the United States, but significant incidents have also been reported in countries like the United Kingdom, Canada, and Australia. This distribution indicates a focus on developed nations with extensive digital infrastructures.

Source: Unit42

Industries targeted by Medusa ransomware

Medusa ransomware has impacted a wide range of industries. High-value targets include healthcare, manufacturing, education, and professional services, reflecting the group's strategy to attack sectors that handle critical and sensitive information.

Source: Unit42

Industries targeted by Medusa ransomware

Medusa ransomware has impacted a wide range of industries. High-value targets include healthcare, manufacturing, education, and professional services, reflecting the group's strategy to attack sectors that handle critical and sensitive information.

Source: Unit42

Medusa ransomware's victims

Medusa has targeted more than 235 victims since 2023.

Source: ransomware.live

Attack Method

Medusa ransomware's attack method

Initial Access
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
Collection
Execution
Exfiltration
Impact
A shadowy figure casting a wide net over a digital landscape filled with various devices such as computers, smartphones, and tablets. The net symbolizes the attacker's attempts to find vulnerabilities or use phishing techniques to gain unauthorized access.

Medusa typically gains access through exploiting vulnerabilities in remote desktop protocols (RDP) and employing phishing campaigns. They also utilize compromised credentials acquired through various means.

A digital ladder extending upwards from a basic user icon towards a crown symbolizing administrative privileges. This represents the attacker's efforts to gain higher-level access within the system.

Once inside a network, Medusa employs tools like PsExec to elevate privileges and establish a stronger foothold within the system.

A chameleon blending into a digital background, with zeroes and ones flowing around it. This represents the attacker's ability to avoid detection by security measures, changing tactics to blend in with normal network traffic.

The group disables security tools using PowerShell scripts and modifies registry settings to avoid detection. They also utilize string encryption techniques to obscure malicious code.

A thief with a lockpick toolkit working on a giant keyhole shaped like a login form, representing the attacker's efforts to steal user credentials to gain unauthorized access.

Medusa harvests credentials using various command-line tools and scripts, allowing them to move laterally across the network.

A magnifying glass moving over a digital map of a network, highlighting files, folders, and network connections. This image represents the phase where attackers explore the environment to understand the structure and where valuable data resides.

They perform extensive network reconnaissance using tools like Netscan to identify valuable targets and gather information on the network topology.

A series of interconnected nodes with a shadowy figure moving stealthily between them. This illustrates the attacker's movements within the network, seeking to gain control of additional systems or spread malware.

Medusa uses legitimate tools and protocols, such as RDP and SMB, to move laterally within the network, leveraging stolen credentials.

A large vacuum sucking up files, data icons, and folders into a bag held by a shadowy figure. This image symbolizes the process of gathering valuable data from the target network.

The ransomware collects sensitive data from the infected systems, preparing it for exfiltration.

A command prompt window open in front of a digital background, with malicious code being typed out. This represents the phase where attackers execute their malicious payload within the compromised system.

The ransomware encrypts files using AES256 encryption, appending the ".medusa" extension to affected files.

A series of files being funneled through a covert channel out of a computer to a cloud labeled with a skull, symbolizing the unauthorized transfer of data to a location controlled by the attacker.

Data is exfiltrated to remote servers controlled by the attackers. This data is then used to pressure victims into paying the ransom.

A cracked screen with a digital cityscape in chaos behind it, symbolizing the destructive impact of the cyberattack, such as service disruption, data destruction, or financial loss.

The final stage involves dropping a ransom note, typically named "!!read_me_medusa!!.txt," instructing victims on how to pay the ransom to decrypt their files. The group uses a mix of RSA and AES encryption to secure the ransom transactions.

A shadowy figure casting a wide net over a digital landscape filled with various devices such as computers, smartphones, and tablets. The net symbolizes the attacker's attempts to find vulnerabilities or use phishing techniques to gain unauthorized access.
Initial Access

Medusa typically gains access through exploiting vulnerabilities in remote desktop protocols (RDP) and employing phishing campaigns. They also utilize compromised credentials acquired through various means.

A digital ladder extending upwards from a basic user icon towards a crown symbolizing administrative privileges. This represents the attacker's efforts to gain higher-level access within the system.
Privilege Escalation

Once inside a network, Medusa employs tools like PsExec to elevate privileges and establish a stronger foothold within the system.

A chameleon blending into a digital background, with zeroes and ones flowing around it. This represents the attacker's ability to avoid detection by security measures, changing tactics to blend in with normal network traffic.
Defense Evasion

The group disables security tools using PowerShell scripts and modifies registry settings to avoid detection. They also utilize string encryption techniques to obscure malicious code.

A thief with a lockpick toolkit working on a giant keyhole shaped like a login form, representing the attacker's efforts to steal user credentials to gain unauthorized access.
Credential Access

Medusa harvests credentials using various command-line tools and scripts, allowing them to move laterally across the network.

A magnifying glass moving over a digital map of a network, highlighting files, folders, and network connections. This image represents the phase where attackers explore the environment to understand the structure and where valuable data resides.
Discovery

They perform extensive network reconnaissance using tools like Netscan to identify valuable targets and gather information on the network topology.

A series of interconnected nodes with a shadowy figure moving stealthily between them. This illustrates the attacker's movements within the network, seeking to gain control of additional systems or spread malware.
Lateral Movement

Medusa uses legitimate tools and protocols, such as RDP and SMB, to move laterally within the network, leveraging stolen credentials.

A large vacuum sucking up files, data icons, and folders into a bag held by a shadowy figure. This image symbolizes the process of gathering valuable data from the target network.
Collection

The ransomware collects sensitive data from the infected systems, preparing it for exfiltration.

A command prompt window open in front of a digital background, with malicious code being typed out. This represents the phase where attackers execute their malicious payload within the compromised system.
Execution

The ransomware encrypts files using AES256 encryption, appending the ".medusa" extension to affected files.

A series of files being funneled through a covert channel out of a computer to a cloud labeled with a skull, symbolizing the unauthorized transfer of data to a location controlled by the attacker.
Exfiltration

Data is exfiltrated to remote servers controlled by the attackers. This data is then used to pressure victims into paying the ransom.

A cracked screen with a digital cityscape in chaos behind it, symbolizing the destructive impact of the cyberattack, such as service disruption, data destruction, or financial loss.
Impact

The final stage involves dropping a ransom note, typically named "!!read_me_medusa!!.txt," instructing victims on how to pay the ransom to decrypt their files. The group uses a mix of RSA and AES encryption to secure the ransom transactions.

MITRE ATT&CK Mapping

TTPs used by Medusa ransomware

Medusa ransomware employs various TTPs aligned with the MITRE ATT&CK framework. Some of the key TTPs include:

TA0001: Initial Access
T1566
Phishing
T1133
External Remote Services
T1078
Valid Accounts
TA0002: Execution
T1059
Command and Scripting Interpreter
TA0003: Persistence
T1098
Account Manipulation
T1078
Valid Accounts
TA0004: Privilege Escalation
T1078
Valid Accounts
TA0005: Defense Evasion
T1112
Modify Registry
T1027
Obfuscated Files or Information
T1070
Indicator Removal
T1562
Impair Defenses
T1078
Valid Accounts
TA0006: Credential Access
T1003
OS Credential Dumping
TA0007: Discovery
T1046
Network Service Discovery
T1018
Remote System Discovery
TA0008: Lateral Movement
T1021
Remote Services
TA0009: Collection
T1115
Clipboard Data
TA0011: Command and Control
T1105
Ingress Tool Transfer
TA0010: Exfiltration
T1041
Exfiltration Over C2 Channel
TA0040: Impact
T1486
Data Encrypted for Impact
Platform Detections

How to Detect Medusa ransomware with Vectra AI

AWS Ransomware S3 Activity

M365 Internal Spearphishing

M365 Ransomware

RDP Recon

Ransomware File Activity

Suspicious Port Scan

View more detections
Assess your attack exposure

FAQs

What is Medusa's primary method of initial access?

Medusa primarily exploits vulnerabilities in remote desktop protocols (RDP) and uses phishing campaigns to gain initial access.

How does Medusa ransomware evade detection?

They use PowerShell scripts and modify registry settings to disable security tools and avoid detection.

Which industries are most targeted by Medusa ransomware?

Healthcare, manufacturing, education, and professional services are among the most targeted industries.

What encryption methods does Medusa ransomware use?

Medusa uses a combination of RSA and AES256 encryption to secure their ransomware transactions and encrypt victim files.

How does Medusa ransomware exfiltrate data?

Data is exfiltrated to remote servers controlled by the attackers, typically over secure channels to avoid detection.

What is the typical ransom note name used by Medusa?

The ransom note is typically named "!!read_me_medusa!!.txt."

What tools does Medusa ransomware use for network discovery?

Medusa uses tools like Netscan for network reconnaissance and to identify valuable targets.

How does Medusa ransomware achieve lateral movement?

They utilize legitimate tools and protocols like RDP and SMB, leveraging stolen credentials to move laterally.

How can organizations protect against Medusa ransomware?

Implementing strong security measures, such as regular patching, using multi-factor authentication, and monitoring network traffic for unusual activity, can help protect against Medusa.

What role can XDR solutions play in defending against Medusa ransomware?

XDR solutions provide comprehensive visibility and automated response capabilities, detecting and mitigating suspicious activities across endpoints, networks, and cloud environments.

Is Your Organization Safe from Medusa Ransomware's Attacks?

Assess your attack exposure