Medusa

Management summary

Medusa is a current ransomware-as-a-service operation. The joint advisory of FBI, CISA and MS-ISAC from March 2025 describes Medusa as a variant used since 2021 and hit more than 300 victims in critical infrastructure sectors until February 2025. For visitors, Medusa is important because it shows a modern extortion chain: initial access smokers, data diode stealing, encryption, leak-sitecountdowns and sometimes extra pressure after payment.

Medusa is not the same as MedusaLocker or Medusa mobile malware. That name confusion is important: indicators and TTP cyclists should be part of the proper operation. The Medusa profile here pertains to the RaaS ransomware variant from the CISA- advisory, with affiliates, central negotiation and double extortion.

The concrete risk message is that organisations are vulnerable when external access, patching, network segmentation, RMM/deployment tools and backup management are not adequately monitored. Medusa uses normal management mechanisms such as PsExec, PDQ Deploy or BigFix to roll out the encryption wide.

Grouping and development

Medusa started as a closed ransomware variant, which essentially managed development and operation. Later the operation developed towards affiliate model, but important parts such as negotiations remained centrally controlled by developers. This makes Medusa both scalable and organized.

The operation uses double extortion: data is stolen and encryption combined with threat to publication. The leak site shows victims with countdowns. Victims can even pay according to the advisory to add extra time to the countdown, which shows how commercial and psychological pressure has been set up.

FBI- also mentioned a case where after payment another actor asked for money again with the story that the previous negotiator had stolen the amount, indicating possible triple-extortion-like pressure and showing that payment does not guarantee a reliable recovery process.

Attack pattern from public cases

Medusa actors use initial access brokers to gain access to victims. This allows the initial vector to vary: stolen credentials, phishing, vulnerabilities or previously compromised systems. For defense, this means that threat hunting cannot stop at the encryption; access may have been purchased days or weeks earlier.

For exfiltration, CISA Rclone is named after Medusa C2- servers. This is a concrete phase before encryption. Search for rclone.exe, configuration, command-lines, large transfers and cloud or external destinations that are not part of normal business.

For deployment, Medusa uses the advisory Sysinternals PsExec, PDQ Deploy or BigFix to roll gaze.exe on systems. This is important because these tools can also be legitimate. The detection should look at unusual usage, many hosts simultaneously, abnormal accounts and timing outside of channelers.

gaze.exe stops services around backups, security, databases, communication, file sharing and websites, removes shadow copies, encrypts with AES-256 and drops a ransom note. Actors also manually disables and encrypts VM drives which directly affects Medusa to recoverability and virtualization management.

Known IOCs and artifacts

gaze.exe is a core artifact from the Medusa advisory. A hit should be linked to process tree, distribution method, account, host list and service-stop events.

The file extension .medusa is a clear impact indicator. As with other extensions, this is mainly late proof; prevention should be at Rclone, deployment tools, service stops and shadow-copy deletion.

Rclone, PsExec, PDQ Deployment and BigFix are important tooling indicators. Not every use is malicious, but unknown use in combination with data volume or mass deployment is high risk.

The leak-sitecountdown, Tox/Tor contact and direct approach via phone or e-mail are extortion artifacts. They belong to the incident file, but technical conclusions should be based on logs and systems.

Victim pattern and lessons

CISA mentions more than 300 victims until February 2025, including medical, education, legal, insurance, technology and production organisations. The pattern is wide, but sectors with sensitive data and high downtime costs are extra attractive.

The lesson from Medusa is that deployment tools and virtualization are part of ransomware weasurability. If PDQ, BigFix, PsExec or hypervisor management with too many rights are available, an actor can quickly increase the impact.

A second lesson is that extortion is professionally designed. Countdowns, sales of data and additional pressure channels are intended to put drivers under time pressure. Therefore prepared communication and data classification are part of security.

How to arm yourself against Medusa

Patch internet-facing systems and restrict unknown access to remote services.Medusa usedIAB .. to prevent access from being negotiable, starting with patching,MFA and credential hygiene.

Segment networks so that a first host does not directly access servers, backups and deployment tools. Limit PsExec, PDQ Deploy, BigFix and similar tooling to approved administrators and logging.

Monitor Rclone and other exfiltration tools. Alerts on configuration files, large outbound transfers, compression and connections to unknown remote servers.

Protect backups, databases, web servers and VM- management from ordinary domain compromise. Medusa stops services and hits VM . Recovery should be possible without confidence in the attacked management layer.

Indicators of compromise (IOCs)

Indicators are historical observations, not proof of a current infection. Validate source, age and context before hunting or blocking; legitimate administrative tools can produce false positives.

Sources

• CISA #StopRansomware: Medusa Ransomware
• Ransomware.live — Medusa

Evidence and limitations

Attribution describes the source assessment, not a verified identity. A leak-site listing alone does not prove encryption, data theft, a particular vulnerability or an affiliate relationship. Missing information is left explicit.