Medusa

Medusa is a ransomware-as-a-service operation. That means the developers write the ransomware and rent it to partners, called affiliates, who break into networks and run the attacks. The FBI, CISA and the US Department of Health and Human Services (HHS) say it was first identified in June 2021. As of April 2026 they count over 500 victims across medical, education, legal, insurance, technology and manufacturing organizations. The FBI states that this Medusa is unrelated to MedusaLocker and to a mobile malware also called Medusa.

From closed group to affiliate model

Per the advisory, Medusa started as a closed operation, where one group controlled development and every campaign. Since at least early 2023 it has sold access to affiliates, who get different levels of trust based on experience and profit. Newer affiliates may not run the ransom negotiation themselves, because the developers can keep that step under central control. The MITRE ATT&CK entry for the group describes the same path from a closed group to a service.

How the attacks work

Medusa actors buy access from initial access brokers, criminals who sell a foothold inside a company. The advisory says they offer these brokers between $100 and $1 million. They also use phishing to steal credentials and exploit unpatched software. The FBI describes the group as opportunistic: it goes after unpatched systems rather than chosen sectors, though healthcare has been a frequent victim. The group acts fast on new flaws, often within 24 hours of an announcement, but there is no sign it writes its own zero-day exploits.

Inside the network, the actors lean on built-in Windows tools and legitimate remote management software, which makes the activity look normal. They dump credentials with Mimikatz, move around with Remote Desktop and PsExec, and copy data out with Rclone. In some cases they tried to switch off endpoint detection tools using vulnerable or signed drivers.

Hiding in plain sight

Medusa hides its tools rather than building new ones. The advisory says the actors rename the Rclone program and its settings file, and place it in folders that Windows Defender is already set to skip. They hide PowerShell commands with encoding and string tricks, and they delete the command history afterwards. On Linux and virtualisation hosts, they use an ESXi host profile to change root passwords, then push the encryptor over secure file transfer. For defenders this means the early signs are often ordinary-looking admin activity, so unusual use of remote management tools and PowerShell deserves attention.

Encryption and extortion

The encryptor is called gaze.exe on Windows and gaze.py on Linux. It stops backup, security and database services, deletes shadow copies, encrypts files with AES-256 and adds the .medusa extension. Medusa uses double extortion: victims pay to get their files back and to stop their stolen data being published. The note gives 48 hours to make contact, and the group may call or email victims who stay silent. A leak site shows countdown timers. The advisory says victims can pay $10,000 to add a day to a timer, and that demands are set from a victim’s published revenue.

The FBI also records one case where a second Medusa actor contacted a victim after payment, claiming the first negotiator had stolen the money, and asked for half again. The agencies say this could point to triple extortion or to poor cohesion inside the group.

The advisory was first published on 12 March 2025 and updated on 18 August 2026 with FBI findings as of April 2026. This page records no law enforcement takedown, because the sources opened for it describe none.

Double extortion. Files are encrypted and stolen data is held for ransom. A leak site shows countdown timers, and a note gives 48 hours to make contact. The group may also phone or email victims.