Medusa
A ransomware-as-a-service operation first identified in June 2021, with more than 500 victims reported by US agencies. It is not related to MedusaLocker or the Medusa mobile malware.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
Your patching window is the risk. The updated US advisory says Medusa actors use newly announced exploits within 24 hours.3 Microsoft says Storm-1175, a financially motivated actor that deploys Medusa, moves from access to data theft and ransomware within days and sometimes under 24 hours.4 The Hacker News describes it as China-based, but Microsoft's analysis does not mention China.5,4
Microsoft names the UK, Australia and the US as affected, with healthcare hit heavily, along with education, professional services and finance.4 The American Hospital Association's adviser says Medusa claimed a high-impact attack on a Level 1 trauma centre this year.6
Do not read Storm-1175 as being all of Medusa. Medusa uses an affiliate model with different levels of trust, and initial access brokers often work for several groups.3 In August 2026 Microsoft said Storm-1175 had moved to a new strain, StormEncryptor.7 That changes one operator's payload. It does not show that the Medusa brand has ended.
Plan for the group to reach exposed systems before a normal patch cycle ends. Being able to isolate or take an exposed service offline quickly may matter more than the patch date itself.
How It Attacks
Combines the updated US advisory3,1 with Microsoft's account of Storm-1175.4 Different affiliates may work differently.
- 1
Get In
Buys access from brokers, phishes for credentials, or exploits unpatched and newly disclosed flaws in web-facing systems.
- 2
Hold On
Creates new accounts and adds them to administrator groups, and often drops a web shell or remote access tool.
- 3
Move and Harvest
Uses PsExec, Impacket, PowerShell and remote access software. Dumps credentials from memory and domain controllers.
- 4
Blind the Defences
Changes Defender settings and adds exclusions, and uses vulnerable or signed drivers to kill EDR tools.
- 5
Take the Data
Compresses files and sends them to attacker cloud storage, using tools such as Rclone.
- 6
Encrypt and Pressure
Deploys ransomware through deployment tools or Group Policy. Gives 48 hours to respond, then may phone or email. Stolen data goes on a leak site with a countdown timer.
Key Techniques
ATT&CK v20 has no Medusa ransomware entry. This mapping is ours, based on behaviour described in the US advisory1 and by Microsoft.4
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | Initial Access | Rapid use of newly disclosed flaws. |
| T1566 | Phishing | Initial Access | Used to steal credentials. |
| T1136 | Create Account | Persistence | New accounts added to administrator groups. |
| T1505.003 | Web Shell | Persistence | Often dropped after exploitation. |
| T1219 | Remote Access Tools | Command and Control | AnyDesk, ConnectWise and SimpleHelp, among others. |
| T1003.001 | LSASS Memory | Credential Access | Mimikatz. |
| T1685 | Disable or Modify Tools | Defense Impairment | Driver abuse and Defender changes. |
| T1072 | Software Deployment Tools | Lateral Movement | PDQ Deploy and BigFix. |
| T1567.002 | Exfiltration to Cloud Storage | Exfiltration | Rclone to attacker-controlled storage. |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files with AES-256. |
Tools Observed
Remote Access
Discovery and Credentials
Tunnelling
Deployment and Data Theft
From the US advisory1 and Microsoft.4 These include legitimate products, so check whether a tool is approved before drawing a conclusion.
Vulnerabilities
The first two come from the March 2025 advisory.1 The rest are from Microsoft's list for Storm-1175, so they describe that actor and not every Medusa affiliate.4 The August 2026 update also has an expanded list that we could not read in full.6
This list will age quickly. Use the Threat Watch feed for exploited vulnerabilities generally, since speed is what defines this threat.
Key Events
First identified.2
Affiliate model in place by this point at the latest.3
FBI, CISA and MS-ISAC publish a joint advisory.1
Microsoft links Storm-1175 to GoAnywhere exploitation and Medusa deployment.9
Microsoft publishes its Storm-1175 analysis, naming UK targeting.4
Microsoft says Storm-1175 first deployed StormEncryptor on 2 August.10,7 On 18 August the FBI, CISA and HHS update their advisory, with more than 500 victims as of April 2026.2
Warning Signs
From Microsoft's account of Storm-1175 and the US advisory.4,1 Treat them as prompts to check.
- New accounts added to administrator groups on web-facing servers
- Web shells or new remote access tools on internet-facing systems
- Firewall changes that enable Remote Desktop
- New Microsoft Defender exclusions or changed tamper settings
- PDQ Deploy, BigFix or PsExec used in unusual ways
- Rclone or Bandizip activity on servers
Defences That Matter
Shrink the Exposed Surface
- Scan your external attack surface.4
- Isolate web-facing systems, and use a WAF, reverse proxy or DMZ.4
- Patch internet-facing systems within a risk-informed timeframe.2
Contain Fast
- Segment networks to limit movement from an infected device.2
- Block untrusted origins from reaching remote services.2
- Be ready to take an exposed service offline before a patch exists.
Protect Credentials and Tools
- Enable Credential Guard and avoid shared local admin passwords.4
- Enforce MFA on approved RMM tools and investigate unapproved installs.4
- Turn on tamper protection to block antivirus exclusion changes.4
Keep Recovery Separate
- Keep encrypted, immutable, offline backups and test restores.1
- Rehearse clinical or service continuity if you are in healthcare.6
How Quickly Can You Respond to a Newly Announced Flaw?
We can help you map exposed systems and test your response against the methods in this profile.
Sources
- FBI, CISA and MS-ISAC: #StopRansomware: Medusa Ransomware, AA25-071A, 12 March 2025
- CISA bulletin: CISA, FBI and HHS Update Joint Advisory on Medusa Ransomware, 18 August 2026
- Help Net Security: Medusa ransomware gang has hit over 500 organizations, CISA warns, 19 August 2026
- Microsoft Threat Intelligence: Storm-1175 focuses gaze on vulnerable web-facing assets in high-tempo Medusa ransomware operations, 6 April 2026
- The Hacker News: report on Storm-1175, 7 April 2026
- American Hospital Association: Agencies issue update on Medusa ransomware activity, 19 August 2026
- The Hacker News: report on Storm-1175 and StormEncryptor, 10 August 2026
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
- Microsoft Threat Intelligence: Investigating active exploitation of CVE-2025-10035 GoAnywhere, 6 October 2025
- Security Affairs, citing Microsoft Threat Intelligence: Storm-1175 Replaces Medusa With New StormEncryptor Ransomware, 13 August 2026
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.