Ransomware.live: medusa

| RaaS

Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.

Victims

517

First Discovered

2023-01-11

victim

Last Discovered

2026-02-14

victim

Inactive Since

172

days

Avg Delay

4.3

days

Infostealer

43.3%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics MITRE ATT&CK Navigator

Attack Velocity — Last 12 months

Known Locations (9)

Title	Available	Last Visit	FQDN
Human Verify	No	2026-04-28T07:25:01	`medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion`
Medusa Chat	No	2026-04-28T07:27:33	`medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion`
Human Verify	No	2026-08-05T17:35:08	`xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion`
503 Service Temporarily Unavailable	No	2026-04-28T07:30:05	`dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid.onion`
Human Verify	No	2026-04-28T07:31:23	`kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion`
Human Verify	No	2026-04-28T07:32:37	`s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion`
	No	2026-04-28T07:34:25	`45.9.148.39`
Human Verify	No	2026-04-28T07:36:17	`cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion`
	No	2026-04-28T07:36:58	`hupxs7ps7md24kpz4lwsbra64abgxjx3pcc2wuca5ibawf2g5hlpfyqd.onion`

Target

Heatmap

Ransom Notes (2)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
Advanced IP Scanner Navicat PDQ Inventory RoboCopy SoftPerfect NetScan placeholder placeholder placeholder placeholder	AnyDesk Atera HCL BigFix N-Able PDQ Deploy ScreenConnect SimpleHelp Splashtop eHorus	EDRSandBlast KillAV ThrottleStop driver placeholder placeholder placeholder placeholder placeholder placeholder	Mimikatz placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder	placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder	Cloudflared FRP Ligolo PuTTY RevSocks placeholder placeholder placeholder placeholder	BITSAdmin Process Explorer PsExec placeholder placeholder placeholder placeholder placeholder placeholder	RClone placeholder placeholder placeholder placeholder placeholder placeholder placeholder placeholder

Vulnerabilities Exploited (1)

This information is provided by Ransomware-Vulnerability-Matrix & Ransomware.live
Vendor	Product	CVE	Source
SimpleHelp	SimpleHelp RMM	CVE-2024-57727	arcticwolf.com

TTPs Matrix (14)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Stealth	Defense Evasion	Credential Access	Discovery	Lateral Movement	Exfiltration	Command and Control	Impact	Resource Development	Defense Impairment
Valid Accounts	Windows Management Instrumentation	Modify Registry	Create or Modify System Process: Windows Service	Obfuscated Files or Information: Software Packing	Impair Defenses	OS Credential Dumping: LSASS Memory	System Network Configuration Discovery	Remote Services	Exfiltration Over C2 Channel	Application Layer Protocol: Web Protocols	Data Encrypted for Impact	Acquire Infrastructure: Web Services	Modify Registry
External Remote Services	Command and Scripting Interpreter	Create Account: Domain Account	Abuse Elevation Control Mechanism: Bypass User Account Control	Obfuscated Files or Information: Command Obfuscation	Disable or Modify Tools	OS Credential Dumping: NTDS	Remote System Discovery	Remote Services: Remote Desktop Protocol	Exfiltration Over Alternative Protocol	Proxy: Multi-hop Proxy	Service Stop	Establish Accounts: Social Media Accounts	Subvert Trust Controls: Code Signing
Exploit Public-Facing Application	Command and Scripting Interpreter: PowerShell	Server Software Component: Web Shell		Indicator Removal: Clear Command History	Safe Mode Boot	Brute Force	System Owner/User Discovery	Software Deployment Tools	Exfiltration Over Web Service	Ingress Tool Transfer	Inhibit System Recovery	Establish Accounts: Email Accounts	Disable or Modify Tools
Phishing	Command and Scripting Interpreter: Windows Command Shell	Create or Modify System Process: Windows Service		Indicator Removal: File Deletion			Network Service Discovery	Lateral Tool Transfer	Exfiltration Over Web Service: Exfiltration to Cloud Storage	Remote Access Tools	System Shutdown/Reboot	Obtain Capabilities: Tool	Disable or Modify System Firewall
	Software Deployment Tools			System Binary Proxy Execution: MMC			Process Discovery			Encrypted Channel: Asymmetric Cryptography	Financial Theft	Stage Capabilities: Upload Tool	Prevent Command History Logging
	Native API			Hide Artifacts: Hidden Window			Permission Groups Discovery: Domain Groups					Acquire Access
	Inter-Process Communication: Component Object Model						System Information Discovery
	System Services: Service Execution						File and Directory Discovery
							Account Discovery: Local Account
							Network Share Discovery
							Software Discovery: Security Software Discovery
							Device Driver Discovery

KQL Query (2)

YARA Rules (1)

Indicators of Compromise (IoCs) (25)

Email 3 Hash MD5 18 telegram 1 tox 3

Type	IOC
`Email`	`MedusaSupport@cock.li`
`Email`	`medusa.support@onionmail.org`
`Email`	`medusasupport@cock.li`
`Hash MD5`	`0067679c7033139bcbb273840494b324`
`Hash MD5`	`0168a4daa9598e991e140057e59438f6`
`Hash MD5`	`10911494fa52daee0279972f91fded01`
`Hash MD5`	`24ccd142ff83e8622f00f5443ea5cb2d`
`Hash MD5`	`4fe99e5dc101170750d8ece6ea066155`
`Hash MD5`	`600371ebab1e29429f06a5b1909056e5`
`Hash MD5`	`602d720f1184d2ad739568cbf6403331`
`Hash MD5`	`6be23d5a1ff1e9cbe99fe7f7c49a5607`
`Hash MD5`	`92a20ba91b4d3b89b57aa95a120667ae`
`Hash MD5`	`983a20479a281a182d33b75c0945e447`
`Hash MD5`	`a162a5c5ab72b3783215f52b9edc3680`
`Hash MD5`	`a6980e543efa40771ed1dcf84b29d732`
`Hash MD5`	`bdf6ac02664baea655b103d50bdfd6ec`
`Hash MD5`	`dc344328208c3481587d0aab1005fcdd`
`Hash MD5`	`e874240a53fc353bc770f507445cc061`
`Hash MD5`	`eb46bc3e2ad88149176ef33c9fea087a`
`Hash MD5`	`ec5b1a6de3564c26c4e0e804e6bc2ecb`
`Hash MD5`	`f05b57cdc3420acc359efe9e4941c428`
`telegram`	`https://t.me/+yXOcSjVjI9tjM2E0`
`tox`	`061AA6BDE8F6DE6C92F0D6E077359BF6911FCAF80030E82B3A3DB65E63C8011343D34F956FEC`
`tox`	`4AE245548F2A225882951FB14E9BF87EE01A0C10AE159B99D1EA62620D91A372205227254A9F`
`tox`	`AEA72DFCF492037A6D15755A74645C7D8E674E342BACA9F9070A3FB74117EC3143FD6E29BEAC`