Medusa: A Threat Profile

Aliases

Medusa Blog (the group’s leak-site branding)
Storm-1175 (Microsoft designation for a China-based Medusa affiliate)

Get Threat Intel and Security Updates Delivered to Your Inbox.

Profiling

Threat Actor Type: Financially motivated ransomware-as-a-service (RaaS) operation using encryption, data theft, and leak-site extortion. Active since June 2021; a joint CISA, FBI, and HHS advisory updated in August 2026 counts more than 500 critical infrastructure victims.

Structure:

Closed group until early 2023, then opened an affiliate program
Core operators maintain the encryptors, leak site, and negotiation infrastructure; affiliates conduct intrusions
Access often bought from initial access brokers for $100 to $1 million

Affiliates:

Storm-1175 (Microsoft): China-based, financially motivated; exploited GoAnywhere MFT and SmarterMail flaws before public disclosure and reaches encryption in about 24 hours
Lazarus Group (North Korea): linked by Symantec and Carbon Black to Medusa attacks on U.S. healthcare organizations and nonprofits, November 2025–February 2026

Tradecraft:

Weaponizes newly disclosed vulnerabilities within 24 hours and uses vulnerability announcements to pick targets
Relies on living-off-the-land tooling and legitimate RMM software
Loads vulnerable kernel drivers to kill EDR before deployment

Extortion:

Countdown timer on the Medusa Blog; $10,000 buys a one-day extension
FBI documented a paying victim contacted by a second “Medusa negotiator” demanding half the ransom again

Malware:

Windows encryptor (gaze.exe) appends .medusa and drops !!!READ_ME_MEDUSA!!!.txt
Linux/ESXi-targeted variant transferred to targets over secure file transfer
Federal advisories document affiliates manually shutting down and encrypting virtual machines
In VMware environments, affiliates log in to vCenter or ESXi with stolen credentials, stop running VMs with esxcli, and encrypt .vmdk files at rest

Motivations

Financial extortion through encryption and stolen-data pressure. Nation-state affiliates participate for revenue; there is no evidence of state direction over the core operation.

Timeline & Victimology

Figure 1: Medusa ransom note.

June 2021 — Emergence

Medusa surfaces as a closed ransomware group, with core operators handling intrusions and negotiations.

Early 2023 — RaaS Launch

Medusa opens its affiliate program and launches the Medusa Blog
First leak-site victims appear in February 2023

March 2025 — First Federal Advisory

CISA, FBI, and MS-ISAC report more than 300 victims across healthcare, education, legal, insurance, technology, and manufacturing
Advisory documents affiliates accessing VMware vCenter or ESXi hosts with stolen credentials, shutting down running virtual machines with esxcli, and encrypting .vmdk files at rest

November 2025–February 2026 — Lazarus Group Affiliate Activity

Symantec and Carbon Black tie North Korea’s Lazarus Group to Medusa attacks on U.S. healthcare organizations and nonprofits.

February 2026 — University of Mississippi Medical Center

Takes down Mississippi’s only Level I trauma center, children’s hospital, and organ transplant program
Systems offline for nine days; all 35 outpatient clinics closed

February 2026 — BeyondTrust Exploited Within 24 Hours

Affiliates begin exploiting BeyondTrust Remote Support and Privileged Remote Access (CVE-2026-1731) within a day of disclosure.

April 2026 — Storm-1175 Attribution

Microsoft identifies Storm-1175 as a China-based Medusa affiliate exploiting vulnerabilities before patches were available.

August 2026 — Updated CISA/FBI/HHS Advisory

Victim count passes 500
Defense, government, IT, and financial services added to the sector list
Documents Linux encryptor deployment and new tooling: GSocket, Nezha, MeshAgent, Ligolo-ng

September 2026 — Active and Ongoing

517 publicly tracked victims across 50 countries; 262 in the U.S.
Healthcare remains the most consistently targeted sector
No law enforcement disruption reported

Tactics & Techniques

Initial Access

T1190 – Exploit public-facing applications (ScreenConnect, FortiClient EMS, GoAnywhere MFT, BeyondTrust)
T1078 – Valid accounts purchased from access brokers
T1566 – Phishing
T1133 – External remote services

Execution & Persistence

T1059.001/ T1059.003 – PowerShell and command shell
T1047 / T1569.002 – WMI and service execution (PsExec, PDQ Deploy)
T1219 – Remote access software (AnyDesk, SimpleHelp, ConnectWise, Atera, Nezha, MeshAgent)

Credential Access & Discovery

T1003 – Credential dumping (Mimikatz)
T1018 / T1046 – System and service discovery (Advanced IP Scanner, SoftPerfect, NetExec)
T1135 / T1482 – Network share and domain trust discovery

Lateral Movement

T1021.001– Remote Desktop Protocol
T1021.004– SSH to Linux, vCenter, and ESXi hosts
T1570 – Lateral tool transfer

Defense Evasion

T1562.001– BYOVD kernel-driver EDR termination
T1562.009– Safe Mode boot to bypass security tools
T1027 / T1036 – Obfuscation and masquerading

Exfiltration & Command and Control

T1560.001 / T1567 – Archive and exfiltrate to web services
T1572 / T1090 – Tunneling and proxy infrastructure (Ligolo-ng, Cloudflared, GSocket, FRP)

Impact

T1486 – Data encrypted for impact (Windows, Linux, and ESXi VM files)
T1529 – Running VMs stopped before encryption
T1490 – Inhibit system recovery
T1657 – Financial extortion

Defensive Recommendations Against Aurora

Watch the hypervisor directly. Medusa’s Linux/ESXi encryptor runs where Windows EDR has no presence. Use runtime behavioral detection on ESXi hosts and alert on bulk VM shutdowns, esxcli vm process kill, and mass .vmdk changes.

Isolate ESXi and vCenter management. Keep management interfaces off the user LAN, disable ESXi SSH when not in use, and require MFA on vCenter. Separate hypervisor administration from production Active Directory.

Patch internet-facing systems within 24 hours. Prioritize ScreenConnect (CVE-2024-1709), FortiClient EMS (CVE-2023-48788), GoAnywhere MFT (CVE-2025-10035), and BeyondTrust (CVE-2026-1731).

Control remote access tools. Maintain an approved RMM list and alert on any other RMM, tunneling, or reverse-proxy tool, especially on servers.

Block driver-based EDR killing. Enforce HVCI and the Microsoft vulnerable driver blocklist, and alert on unexpected bcdedit Safe Mode changes. Use protection that cannot be terminated from a compromised guest.

Plan recovery without the decryptor. Keep immutable, offline backups of VMs and hosts. Post-payment extortion is documented, and deletion from the leak site cannot be verified.