medusaMalware
The ransomware landscape remains active in 2024, with various ransomware groups attacking a wide range of organizations. In this context, Medusa Ransomware has emerged as a significant cyber threat, standing out for its data encryption and extortion operations. Medusa Ransomware appeared in 2021, quickly becoming one of the most feared cyber threats.From MISP Galaxy
Last reported 2 months ago, by Infosecurity Magazine2 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1055.004Asynchronous Procedure Call
“To terminate the thread, the malware queues an APC (asynchronous procedure call) to execute code in the context of the targeted thread.”
- T1110Brute Force
“For each process, it iterates over their handles, also using brute force, and checks if the underlying object corresponds to the client process.”
- T1222File and Directory Permissions Modification
“File and Directory Permissions Modification”
- T1553.002Code Signing
“Code Signing”
- T1684Social Engineering
“"Attackers Leveraging Microsoft Teams Defaults and Quick Assist for Social Engineering Attacks", January 31 2025.”
- T1685Disable or Modify Tools
“Disable or Modify Tools”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Over 500 Critical Infrastructure Organizations Hit by Medusa Ransomware“The encrypted files have a .medusa file extension, which terminates all services and deletes shadow copies before dropping a ransom note to the victim.”
-
Shedding light on the ABYSSWORKER driver“Elastic Security Labs has monitored a financially motivated campaign deploying MEDUSA ransomware through the use of a HEARTCRYPT-packed loader.”
Indicators in its reports
named in the reports above- hxxps://github[.]com/elastic/protections-artifacts/blob/main/yara/rules/Windows_Rootkit_AbyssWorker.yarin 1 report
- 6a2a0f9c56ee9bf7…8cc5b1e8d050in 1 report
- b7703a59c39a0d2f…7551b8eed505in 1 report
- hxxps://github[.]com/wavestone-cdt/EDRSandblast/tree/masterin 1 report
- hxxps://github[.]com/myzxcg/RealBlindingEDRin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.