Ransomware.live: medusa

| RaaS

Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.

Victims

517

First Victim

2023-01-11

(est. attack date)

Discovery Date

2023-01-11

Last Seen

2026-02-14

Inactive Since

198

days

Avg Delay

4.3

days

Infostealer

43.3%

victims with domain

Countries

hit

Uptime

0.0% avg (30d)

View Victims on World Map View Group Statistics MITRE ATT&CK Navigator

Attack Velocity — Last 12 months (based on attack estimated date if available)

Known Locations (11)

Title	Available	Last Visit	FQDN
Human Verify	No	2026-08-22T08:23:35	`medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion`
Medusa Chat	No	2026-08-22T08:19:40	`medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion`
Human Verify	No	2026-08-22T08:22:25	`xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion`
503 Service Temporarily Unavailable	No	2026-08-22T08:23:12	`dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid.onion`
Human Verify	No	2026-08-22T08:23:00	`kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion`
Human Verify	No	2026-08-22T08:22:49	`s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion`
	No	2026-08-22T08:20:50	`45.9.148.39`
Human Verify	No	2026-08-22T08:23:23	`cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion`
	No	2026-08-22T08:22:37	`hupxs7ps7md24kpz4lwsbra64abgxjx3pcc2wuca5ibawf2g5hlpfyqd.onion`
	No	2026-08-31T07:35:42	`62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion`
	No	2026-08-31T07:35:14	`7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id.onion`

Target

Heatmap

Ransom Notes (2)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Advanced IP Scanner Navicat PDQ Inventory RoboCopy SoftPerfect NetScan placeholder placeholder placeholder placeholder	AnyDesk Atera HCL BigFix N-Able PDQ Deploy ScreenConnect SimpleHelp Splashtop eHorus	EDRSandBlast KillAV ThrottleStop driver placeholder placeholder placeholder placeholder placeholder placeholder	Mimikatz placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder	Cloudflared FRP Ligolo PuTTY RevSocks placeholder placeholder placeholder placeholder	BITSAdmin Process Explorer PsExec placeholder placeholder placeholder placeholder placeholder placeholder	RClone placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder

Vulnerabilities Exploited (1)

This information is provided by Ransomware-Vulnerability-Matrix & Ransomware.live
Vendor	Product	CVE	Source
SimpleHelp	SimpleHelp RMM	CVE-2024-57727	arcticwolf.com

TTPs Matrix (14)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Stealth	Defense Evasion	Credential Access	Discovery	Lateral Movement	Exfiltration	Command and Control	Impact	Resource Development	Defense Impairment
Valid Accounts	Windows Management Instrumentation	Modify Registry	Domain or Tenant Policy Modification: Group Policy Modification	Direct Volume Access	Impair Defenses	OS Credential Dumping: LSASS Memory	System Network Configuration Discovery	Remote Services	Exfiltration Over C2 Channel	Application Layer Protocol: Web Protocols	Data Encrypted for Impact	Acquire Infrastructure: Web Services	Modify Registry
External Remote Services	Command and Scripting Interpreter	Create Account: Domain Account	Create or Modify System Process: Windows Service	Obfuscated Files or Information	Disable or Modify Tools	OS Credential Dumping: NTDS	Remote System Discovery	Remote Services: Remote Desktop Protocol	Exfiltration Over Alternative Protocol	Proxy: Multi-hop Proxy	Service Stop	Establish Accounts: Social Media Accounts	Subvert Trust Controls: Code Signing
Exploit Public-Facing Application	Command and Scripting Interpreter: PowerShell	Server Software Component: Web Shell	Abuse Elevation Control Mechanism: Bypass User Account Control	Obfuscated Files or Information: Software Packing	Safe Mode Boot	Brute Force	System Owner/User Discovery	Software Deployment Tools	Exfiltration Over Web Service	Ingress Tool Transfer	Inhibit System Recovery	Establish Accounts: Email Accounts	Disable or Modify Tools
Phishing	Command and Scripting Interpreter: Windows Command Shell	Create or Modify System Process: Windows Service		Obfuscated Files or Information: Command Obfuscation		Steal or Forge Kerberos Tickets	Network Service Discovery	Lateral Tool Transfer	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Remote Access Tools	System Shutdown/Reboot	Obtain Capabilities: Tool	Disable or Modify System Firewall
	Software Deployment Tools			Obfuscated Files or Information: Encrypted/Encoded File			System Network Connections Discovery			Encrypted Channel: Asymmetric Cryptography	Financial Theft	Stage Capabilities: Upload Tool	Prevent Command History Logging
	Native API			Indicator Removal			Process Discovery					Acquire Access
	Inter-Process Communication: Component Object Model			Indicator Removal: Clear Command History			Permission Groups Discovery: Domain Groups
	System Services: Service Execution			Indicator Removal: File Deletion			System Information Discovery
	ESXi Administration Command			System Binary Proxy Execution: MMC			File and Directory Discovery
				Hide Artifacts: Hidden Window			Account Discovery: Local Account
				Hide Artifacts: File/Path Exclusions			Network Share Discovery
							Software Discovery: Security Software Discovery
							Device Driver Discovery

KQL Query (2)

YARA Rules (1)

Indicators of Compromise (IoCs) (25)

Email 3 Hash MD5 18 Telegram 1 Tox 3

Type	IOC
`Email`	`MedusaSupport@cock.li`
`Email`	`medusa.support@onionmail.org`
`Email`	`medusasupport@cock.li`
`Hash MD5`	`0067679c7033139bcbb273840494b324`
`Hash MD5`	`0168a4daa9598e991e140057e59438f6`
`Hash MD5`	`10911494fa52daee0279972f91fded01`
`Hash MD5`	`24ccd142ff83e8622f00f5443ea5cb2d`
`Hash MD5`	`4fe99e5dc101170750d8ece6ea066155`
`Hash MD5`	`600371ebab1e29429f06a5b1909056e5`
`Hash MD5`	`602d720f1184d2ad739568cbf6403331`
`Hash MD5`	`6be23d5a1ff1e9cbe99fe7f7c49a5607`
`Hash MD5`	`92a20ba91b4d3b89b57aa95a120667ae`
`Hash MD5`	`983a20479a281a182d33b75c0945e447`
`Hash MD5`	`a162a5c5ab72b3783215f52b9edc3680`
`Hash MD5`	`a6980e543efa40771ed1dcf84b29d732`
`Hash MD5`	`bdf6ac02664baea655b103d50bdfd6ec`
`Hash MD5`	`dc344328208c3481587d0aab1005fcdd`
`Hash MD5`	`e874240a53fc353bc770f507445cc061`
`Hash MD5`	`eb46bc3e2ad88149176ef33c9fea087a`
`Hash MD5`	`ec5b1a6de3564c26c4e0e804e6bc2ecb`
`Hash MD5`	`f05b57cdc3420acc359efe9e4941c428`
`Telegram`	`https://t.me/+yXOcSjVjI9tjM2E0`
`Tox`	`061AA6BDE8F6DE6C92F0D6E077359BF6911FCAF80030E82B3A3DB65E63C8011343D34F956FEC`
`Tox`	`4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F`
`Tox`	`AEA72DFCF492037A6D15755A74645C7D8E674E342BACA9F9070A3FB74117EC3143FD6E29BEAC`