Medusa is a ransomware-as-a-service (RaaS) operation that has been active since 2021. In an August 2026 update to AA25-071A, CISA, the FBI, and HHS reported that Medusa developers and affiliates had affected more than 500 victims across critical infrastructure sectors as of April 2026. Medusa is unrelated to MedusaLocker ransomware and the Medusa mobile malware family.

Because affiliates conduct the intrusions, Medusa attacks do not follow a single playbook. In October 2025, Microsoft linked Storm-1175 to the exploitation of GoAnywhere MFT followed by a Medusa deployment. In February 2026, Symantec and Carbon Black attributed two Medusa-related intrusions to Lazarus. Despite their different operators, these attacks share a recognizable sequence: exploit exposed systems, steal credentials, abuse legitimate tools, move laterally, exfiltrate data, disrupt security controls, and encrypt systems. The pattern is clear: exfiltrate first, encrypt second.

Many of these behaviors remain visible on the network even when endpoint defenses are impaired. The following sections examine the common stages of a Medusa intrusion and the signals ExtraHop RevealX can correlate across assets, identities, and peer groups.

One Ransomware, Many Operators

Affiliates (CISA/FBI): Actors recruit initial access brokers, paying $100 to $1 million USD and may offer an exclusive working relationship. Affiliates favor phishing and exploitation of unpatched vulnerabilities such as BeyondTrust vulnerability (CVE-2026-1731) and Fortra GoAnywhere vulnerability (CVE-2025-10035). Healthcare and Public Health organizations have been frequent targets.

Storm-1175 (Microsoft): Microsoft describes Storm-1175 as a high-tempo operator that usually exploits N-day vulnerabilities but has also used zero-days. In cases involving GoAnywhere MFT (CVE-2025-10035) and SmarterMail (CVE-2026-23760), researchers observed exploitation roughly a week before disclosures. In some cases, this group rapidly moves from initial access to exfiltration and deployment of Medusa within 24 hours. Other campaigns have targeted Exchange, Ivanti, TeamCity, SimpleHelp, and SAP NetWeaver.

Lazarus Group (Symantec/Carbon Black): Lazarus actors commonly gain initial access using credential theft, phishing or exploitation techniques. In 2025, Symantec and Carbon Black Threat Hunter Team linked two Medusa-related intrusions to North Korean actors. One ended in ransomware deployment at an organization in the Middle East. The other targeted a U.S. healthcare organization but was unsuccessful.

Medusa Ransomware Attack Lifecycle

Phase 1: Exploit the Edge and Establish a Foothold

Medusa affiliates have several routes into a network:

• Purchased access: Initial access brokers can provide a ready-made foothold, allowing an affiliate to bypass much of the work involved in identifying and compromising a target.
• Phishing [T1566]: Stolen credentials may later be used as valid accounts [T1078], making the session look deceptively ordinary.
• Exploitation of public-facing applications [T1190]: Internet-exposed systems offer a scalable path into an organization without requiring a user to open a file or trick users to disclose their credentials.

The CISA advisory cites exploitation of BeyondTrust CVE-2026-1731, Fortra GoAnywhere MFT CVE-2025-10035, ScreenConnect CVE-2024-1709, and Fortinet EMS CVE-2023-48788. In some cases, Medusa-linked actors targeted newly disclosed vulnerabilities within a day.

The actors also used dynamic Interactsh URLs under `oast.site`, `oast.pro`, and `oast.fun` to test whether exploitation succeeded and identify responding hosts. Because these services also support legitimate security testing, a callback alone does not confirm compromise or attribution to Medusa. It warrants investigation when it follows a suspicious request to a vulnerable application or coincides with other indicators of compromise.

Phase 2: Create Durable, Covert Operator Control

Reverse Shells and Tunnelling

After gaining a foothold, operators establish command channels that can blend with legitimate traffic. Reported Medusa activity includes ‘powerfun.ps1’, which creates a TLS-protected bind or reverse shell over port 443 [T1071.001]. Affiliates have also used Cloudflared and Ligolo-ng [T1572] to reach internal services through encrypted outbound tunnels rather than exposed inbound listeners. Because these tools rely on trusted infrastructure and common ports, their traffic can resemble permitted activity.

Legitimate Tool Abuse

Operators reduce their reliance on overtly malicious tooling by using Windows utilities and other LOLBAS. Observed techniques include transferring tools with ‘certutil.exe’ [T1105], executing Base64-encoded or otherwise obfuscated commands [T1027], and deleting  PowerShell history [T1070.003] to conceal activity.

Network Discovery

Once connected, operators map internal hosts, services, and administrative pathways. Affiliates use commercial scanners, NetExec, and custom scripts to discover internal hosts and services  [T1046]. PowerShell, the Windows command shell [T1059.003], and WMI [T1047] support further enumeration of administrative, file-transfer, web, and database services.

​Phase 3: Impair Defense and Credential Theft

Before deploying ransomware broadly, Medusa affiliates often try to weaken or disable endpoint protection [T1562.001]. Unit 42 reported the use of kernel drivers designed to terminate security products. Elastic Security Labs later analyzed ABYSSWORKER, a malicious driver named ‘smuol.sys’ that masqueraded as a CrowdStrike Falcon driver and was signed with a revoked certificate. It can terminate processes and threads, remove notification callbacks, detach minifilter devices, and disrupt EDR visibility. Other incidents involved KillAV, BYOVD tooling, disabled Windows Defender, or tools placed in Defender exclusion paths.

With security controls degraded, operators pivot to harvesting credentials. Reported techniques include dumping LSASS memory [T1003.001] with Mimikatz, Task Manager, or ‘comsvcs.dll’; logging plaintext credentials with ‘mimilib.dll’; and accessing volume shadow copies [T1006] access to extract ‘ntds.dit’ and registry hives [T1003.003].

Domain-wide credentials can enable affiliates to modify the default domain policy  [T1484.001], override restrictive Group Policy settings, and simplify lateral movement or ransomware deployment.

Phase 4: Lateral Movement and Stage Stolen Data

With privileged access, Medusa operators move through Windows environments using familiar administrative pathways using RDP and RMM tools. RDP provides interactive access [T1021.001], while abuse of legitimate RMMs can blend into routine administrative activity.

FBI investigations found PsExec copying scripts to remote hosts, executing local files with ‘system’ privileges, and opening remote command shells. One observed script, ‘openrdp.bat’ created firewall rules for inbound RDP and WMI traffic, then modified the registry to permit RDP connections.

Before encryption, affiliates stage and exfiltrate stolen data. Reported techniques include creating archives with Bandizip [T1560.001], using renamed Rclone to transfer data to cloud or actor-controlled infrastructure [T1567.002], and moving smaller batches through RDP sessions with ‘rdpclip.exe’.

Phase 5: Distribute Gaze Malware

Medusa actors have used PsExec alongside software-deployment platforms such as PDQ Deploy and BigFix [T1072] to distribute ransomware across many systems at once.

The CISA advisory describes a custom PDQ workflow that added the ‘C:’ drive to Windows  Defender exclusions. Further, it copied ‘gaze.exe’ into ‘C:\Windows\System32’, verified its presence, and executed it. On the network, this stage may appear as a sudden burst of administrative traffic from a central management system, remote-service launches, SMB executable transfers, or software-distribution activity outside a normal change window.

Linux and virtualization infrastructure require a different deployment path. Reported techniques include delivering the Python encryptor ‘gaze.py’ [T1105] over SFTP and using an ESXi host profile to change root passwords [T1675]. New SSH and SFTP connections involving rarely administered servers can provide an early warning of unauthorized deployment.

Phase 6: Encrypt Systems and Escalate Extortion

On Windows, ‘gaze.exe’ stops backup, security, database, communications, file-sharing, and web services [T1489]. It then deletes shadow copies to inhibit recovery [T1490], encrypts data with AES-256 [T1486], appends the .medusa extension, and drops a ransom note.

Operators may shut down virtual machines [T1529] before encryption and remove installed tools afterwards [T1070.004], limiting the evidence available to responders.

Detect the Behavior: MITRE ATT&CK to ExtraHop Mapping

The following mappings connect general Medusa behaviors to ExtraHop RevealX detections. They identify suspicious activity, not a specific threat actor.

Defensive Implications and Network Detection Capabilities

Legitimate tools are difficult to judge in isolation. RMM software and RDP support routine administration, while Cloudflared and Rclone have valid business uses. The behavioral sequence can reveal anomalies from the environment’s normal traffic baseline.

Consider one host that performs an internal scan, initiates a previously unseen RMM session, creates a tunnel, launches PsExec services on several peers, transfers executables through SMB, then uploads a new archive. Each action has a possible administrative explanation. Together, within a short period and tied to the same identity, they describe an action chain that is much harder to dismiss.

Potential behavioral signals include:

• Interactsh callbacks following suspicious requests to a vulnerable server.
• First-time RMM or tunneling activity from a system with no administrative reason to initiate it.
• Internal scanning followed by WMI, RDP, SMB administrative-share, or remote-service activity.
• Remote services launching a LOLBAS or transferring executables through SMB.
• New archive uploads, large outbound transfers, or Rclone connections to unapproved infrastructure.
• Rapid software distribution followed by high-volume SMB writes or elevated file-entropy indicators.
• Continued network activity after endpoint telemetry drops or a security agent becomes unreachable.

When RevealX raises an alert, analysts should identify the associated user, review the source and destination peers, inspect earlier downloads, and look for related remote sessions or file transfers. A timeline centered on the host and identity can distinguish routine administration from a coordinated ransomware operation.

Recommended Defensive Actions

1. Patch the edge first. These actors have exploited new vulnerabilities within a day. For internet-facing software, the patching window should be as short as possible. Investigate  Interactsh callbacks after odd web requests.
2. Know permitted RMM tools. Inventory approved RMM and tunnel software restricted to the necessary users. Alert when a tool or external peer appears for the first time on a sensitive asset.
3. Constrain east-west administration: Limit RDP, WMI, SMB admin shares, SSH, and SFTP to designated management systems. It’s tedious, but it can work to slow down or stop an attacker.
4. Protect privileged accounts. Minimize standing administrator access, rotate exposed secrets, harden domain controllers, and monitor for LSASS and ntds.dit access.
5. Monitor data leaving the network. Baseline archive uploads and cloud-storage use. Identifying a server that’s never communicated with a cloud service suddenly uploading an archive is worth investigating.
6. Harden deployment infrastructure: Limit PDQ Deploy, BigFix, PsExec, and similar tools to approved users and signed packages.  Alert on sudden mass distribution outside change windows.
7. Backups: Maintain offline or immutable backups, protect backup credentials and management interfaces, and regularly test restoration and isolation procedures.

References

• CISA: #StopRansomware: Medusa Ransomware — AA25-071A
• DarkTrace: Under Medusa’s Gaze: How Darktrace Uncovers RMM Abuse in Ransomware Campaigns
• Elastic Security Labs: Shedding Light on the ABYSSWORKER Driver
• Microsoft: Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations
• Palo Alto Networks Unit 42: Medusa Ransomware Turning Your Files into Stone
• Seceon: When Nation-State Actors Turn to Ransomware: Inside Lazarus Group’s Medusa Campaign
• Symantec and Carbon Black: North Korean Lazarus Group Now Working With Medusa Ransomware