Medusa RansomwareMalware
Medusa Ransomware has been utilized in attacks since at least 2021. Medusa Ransomware has been known to be utilized in conjunction with living off the land techniques and remote management software. Medusa Ransomware has been used in campaigns associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish…From MITRE ATT&CK
Last reported 22 days ago, by Silent Push3 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1684Social Engineering
“Its paid tiers advertise tools and personas for exploit research, reverse engineering, social engineering, and financial tracing.”
- T1110.004Credential Stuffing
“…ese apps, while not malware, can create exposure to internal resources and make a corporate IP address appear to be the source of credential stuffing, fraud, or other abusive activity.”
- T1219Remote Access Tools
“Google’s threat-intelligence team and the FBI said the group uses fake IT-support calls, phishing emails, legitimate remote-access tools, and, in some cases, people impersonating technicians to gain physical access.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Weekly Cybersecurity Roundup: How Stolen Credentials Continue to Fuel Fraud“Medusa Ransomware Linked to Over 500 Victims as Affiliates Accelerate Vulnerability Exploitation”
-
From ‘High/Medium/Low’ to Dollars: Making Cyber Risk Legible to Your CFO“Medusa Ransomware Surge: 60 Victims in 3 Months—Are You Next?”
-
Over 500 Critical Infrastructure Organizations Hit by Medusa Ransomware“Over 500 Critical Infrastructure Organizations Hit by Medusa Ransomware”
Indicators in its reports
named in the reports above- ntuser[.]manin 1 report
Copy this indicator · defanged
Thanks — we review every report.