Medusa
CriticalRansomware
Also known as: MedusaLocker (distinct family)
A ransomware-as-a-service group that uses double extortion and public "name and shame" leak sites.
What it is
Medusa is a ransomware-as-a-service operation that has targeted businesses across healthcare, education, manufacturing and professional services. Like other modern ransomware, it combines file encryption with data theft, pressuring victims by threatening to publish stolen data and even running countdown timers on a public leak site.
How it works
- 1
Initial access is gained through phishing, exposed remote services, or exploiting unpatched internet-facing applications.
- 2
Operators disable security tooling and delete backups and shadow copies to prevent easy recovery.
- 3
Sensitive data is exfiltrated for extortion leverage.
- 4
Files are encrypted and a ransom note directs the victim to a dark web negotiation portal.
- 5
If payment is refused, stolen data is published, sometimes with a paid "extend the timer" option to increase pressure.
Warning signs
- Backup jobs failing or shadow copies being deleted
- Security software alerts being suppressed or turned off
- Unexpected new admin accounts or remote access tools appearing
- Staff reporting files they cannot open, with new ransom-note text files nearby
Business impact
- Operational shutdown while systems are rebuilt and restored
- Regulatory and privacy obligations triggered by data theft
- Reputational damage from public exposure on a leak site
- Significant financial cost across recovery, legal and customer notification
How to defend against it
Harden and monitor remote access
Put remote access behind MFA, limit it to known users, and alert on logins from unusual locations or times.
Protect your backups
Use immutable or offline backups that ransomware cannot delete, and confirm restores work through regular testing.
Patch and reduce your attack surface
Remove or patch exposed services. Every unpatched internet-facing system is a potential entry point.
Detect early
Endpoint detection and response (EDR) plus monitored alerts help you catch an intrusion before encryption begins.
Measure your defences
Use these free Cyber Toolkit tools to check how exposed you are and close the gaps this threat exploits.
Ready to strengthen your protection?
Book a free security check and we'll show you where your business stands clear next steps, no jargon, no obligation.
If you are unable to reach us by phone, please email and a member of our team will respond promptly.
Or explore our free security tools — 30+ scanners, checkers and assessments, free with an account.