Summary
This advisory provides tactics, techniques, and procedures (TTPs), indicators of compromise (IOCs), and detection methods associated with known Medusa ransomware activity. Medusa is a ransomware-as-a-service variant used to conduct ransomware attacks; as of December 2024, over 300 victims from critical infrastructure sectors have been impacted. Medusa actors use common techniques like phishing campaigns and exploiting unpatched software vulnerabilities. Immediate actions organizations can take to mitigate Medusa ransomware activity: Filter network traffic by preventing unknown or untrusted origins from accessing remote services. This product is provided subject to this Notification and this Privacy & Use policy.