medusa Ransomware Group

Key insights

• •Medusa employs sophisticated techniques including advanced encryption algorithms and obfuscation methods.
• •They primarily target healthcare and financial sectors but have also begun exploiting supply chains through compromised managed service providers.
• •The group utilizes double extortion methods, encrypting data and threatening to release sensitive information if the ransom is not paid.
• •Medusa has been linked to other ransomware groups and operates on a ransomware-as-a-service model.
• •Their initial access often comes from phishing campaigns, exploiting software vulnerabilities, and unsecured RDP connections.
• •Medusa has a notable presence on public channels to pressure victims, under aliases associated with their operations.