Medusa is a ransomware-as-a-service operation that can encrypt systems and threaten to publish stolen data. The FBI, CISA, and MS-ISAC’s March 12, 2025 joint advisory reported more than 300 victims across critical infrastructure sectors as of February 2025. For defenders, the practical priorities are to close known access paths, limit lateral movement, protect tested backups, and have a reporting and recovery plan ready.
What is Medusa ransomware?
The FBI, CISA, and MS-ISAC describe Medusa as a ransomware-as-a-service (RaaS) variant first identified in June 2021. In a RaaS operation, developers provide or operate the ransomware while affiliates carry out attacks; the advisory says Medusa later adopted an affiliate model after initially operating as a closed operation. Important activity, including ransom negotiation, remained centrally controlled by the developers.
As an Amazon Associate I earn from qualifying purchases.
As of February 2025, the FBI, CISA, and MS-ISAC reported that Medusa developers and affiliates had impacted more than 300 victims across critical infrastructure sectors, including medical, education, legal, insurance, technology, and manufacturing. That figure is the agencies’ count as of that date, not a current total. This Medusa is distinct from MedusaLocker and the Medusa mobile malware variant.
How the extortion works
The advisory describes double extortion: attackers encrypt data and threaten to publish data they have stolen if the victim does not pay. It also recounts one investigated case in which, after a ransom payment, another actor claimed that the negotiator had stolen the money and demanded an additional half-payment for a “true decryptor.” The agencies said that incident could indicate triple extortion; it should not be treated as the standard Medusa model.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How Medusa can gain access and move through a network
The 2025 advisory describes several access paths, rather than a single signature that defenders can rely on. Initial access brokers recruited through criminal forums and marketplaces, phishing used to steal credentials, and exploitation of unpatched software are among the methods reported.
- Exploitation of vulnerabilities: The advisory names ScreenConnect CVE-2024-1709 and Fortinet EMS CVE-2023-48788 as examples. Check whether affected products and versions exist in your environment, then prioritize remediation according to exposure and risk.
- Stolen credentials: Phishing can put valid accounts in an attacker’s hands. Review authentication and access patterns, especially for remote access, webmail, and accounts with elevated privileges.
- Discovery and lateral movement: Investigated activity included use of Advanced IP Scanner and SoftPerfect Network Scanner, as well as PowerShell, Windows Command Prompt, and Windows Management Instrumentation.
- Transfer or evasion activity: The advisory also describes use of certutil. Its presence alone does not establish a Medusa infection.
These are behaviors observed in cases covered by the 2025 advisory—not proof that a specific tool, command, or vulnerability use means an organization has been hit by Medusa. The advisory maps behaviors to MITRE ATT&CK Enterprise framework version 16, including data encryption for impact and interference with recovery.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Why the 2025 technical details need caution
The advisory describes gaze.exe terminating services and deleting shadow copies before encrypting files with AES-256 and dropping a ransom note. Treat those details and any indicators associated with the March 2025 advisory as historical reporting, not a complete or current detection list. The FBI’s ransomware page lists a Medusa alert dated August 18, 2026, but the specific changes in that alert are not established here. Check the latest official FBI, CISA, or MS-ISAC material before using indicators as a blocklist or basing detection decisions on them.
How to protect an organization from Medusa
The joint advisory’s immediate priorities are to mitigate known vulnerabilities through risk-informed patching, segment networks to restrict lateral movement, and filter traffic so unknown or untrusted origins cannot access internal remote services. Build those actions into a broader set of preventive controls:
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Prioritize exposed systems: Maintain an inventory of internet-facing and remote-access systems, identify affected software, and apply security updates promptly. Assess urgency using exposure and organizational risk rather than treating every update as interchangeable.
- Require multifactor authentication: Apply MFA to webmail, VPN, and critical-system accounts. Review who can access those systems and remove access that is no longer required.
- Restrict network reach: Segment systems and filter traffic between network zones. Disable unused ports and keep internal remote services inaccessible to untrusted origins.
- Watch for suspicious access and scanning: Monitor for unauthorized scanning, unusual access attempts, and activity that does not fit the expected use of administrative tools. Investigate in context rather than treating a legitimate utility as conclusive evidence of compromise.
- Test security controls: Validate that controls can detect or limit the techniques described in the advisory. Use the advisory’s ATT&CK mapping as a way to organize coverage, not as a substitute for testing against your environment.
How to make backups useful during a ransomware incident
A backup is valuable only if it covers the systems and data the organization needs and can be restored when production systems are unavailable. The advisory recommends multiple copies of sensitive data and servers in physically separate, segmented, secure locations; offline backups; regular backup and restoration maintenance; and backups that are encrypted, immutable, and cover the organization’s data infrastructure.
| Backup property | What it changes | Defender’s check |
|---|---|---|
| Offline rather than continuously connected | An offline copy is less exposed to attacks that reach connected systems. | Confirm that copies can be disconnected or otherwise kept offline, and that the recovery process does not depend on access to compromised production systems. |
| Segmented and physically separate rather than network-accessible from production | Separation can limit an attacker’s ability to reach backup infrastructure through the production network. | Review network paths and administrative access between production, backup, and recovery environments. |
| Immutable rather than mutable | Immutability is intended to prevent a protected copy from being changed or deleted during its retention period. | Verify which copies are immutable, for how long, and which accounts or processes can alter retention settings. |
| Encrypted rather than unencrypted | Encryption helps protect backup data from unauthorized access. | Check encryption coverage and ensure authorized recovery staff can access the required keys during an incident. |
| Complete coverage rather than selected files only | Recovery can fail if essential systems, configurations, or data are outside the backup scope. | Map backup coverage to the organization’s data infrastructure and recovery priorities. |
| Restoration tested rather than assumed | A successful backup job does not by itself prove that systems can be restored. | Practice restoration regularly and maintain the procedures, access, and dependencies needed to complete it. |
A physically separate hard drive is one possible component of offline storage, not a full backup strategy on its own. A drive does not automatically provide network segmentation, immutability, encryption, organizational coverage, or a tested restoration process.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
What to do if Medusa or another ransomware attack is suspected
Use the organization’s incident-response plan and bring in qualified incident responders. The steps below are general priorities, not a substitute for incident-specific forensic, legal, or regulatory advice.
- Escalate and coordinate: Notify the incident-response lead, security team, and relevant leadership using established channels. Engage appropriate internal or external specialists.
- Contain carefully: Follow the response plan to limit further access and spread while preserving information needed to investigate. Coordinate decisions about systems and network connections with incident responders.
- Preserve evidence and document events: Record the time the activity was discovered, affected systems and accounts, observed impact, suspected initial access, host and network indicators, relevant communications, and ransom-note material. Keep records in a way that supports investigation and reporting.
- Assess recovery options: Identify trusted backup copies and determine whether they can be restored safely. Validate the recovery environment and follow tested procedures; do not assume that the presence of backups means recovery is assured.
- Report the incident: The FBI advises victims to contact a local FBI field office or report through IC3. The joint advisory also identifies FBI and CISA reporting routes. Share relevant incident details and evidence through appropriate official channels.
Should an organization pay a Medusa ransom?
The FBI’s guidance states: “The FBI does not support paying a ransom in response to a ransomware attack.” The joint advisory likewise does not encourage payment. Payment does not guarantee that files will be recovered, and may encourage further targeting or fund criminal activity. A reported incident involving a disputed payment and a later demand for an additional half-payment illustrates why a payment cannot be treated as a reliable recovery mechanism.
Quick Recap
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
