Medusa
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 27 incidents
- Sources
- 17 sources
- First seen
- 2022-11-15
- Last seen
- 2026-09-07
- Updated
- 2026-10-13 11:46
- Aliases
- 2 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
Medusa ransomware, also known as MedusaLocker, is a criminal ransomware‑as‑a‑service group believed to operate from Russia. It primarily targets Windows environments across the technology, education, manufacturing, healthcare and retail sectors, with victims most frequently in the United States followed by the United Kingdom, and has also been observed in Australia, Chile, Tonga and Italy. The gang’s strategic objective is financial gain, employing both encryption‑based ransomware and pure data‑theft extortion; it threatens to publish stolen data unless a payment is made, sometimes offering options to delete data or extend deadlines for additional fees. Observed tactics include exploiting vulnerable Remote Desktop Protocol services, using phishing‑laden PowerShell scripts, and living‑off‑the‑land techniques that leverage legitimate remote‑management tools to move laterally, disable defenses such as Microsoft Defender, modify registry keys and create scheduled tasks. Medusa operates under an affiliate model where partners receive roughly sixty percent of ransom payments, and it maintains a darknet leak site to validate claims and pressure victims. Representative incidents include the 2025 attack on Bell Ambulance that exposed data of nearly 238,000 individuals, the 2025 claim against UK health provider HCRG Care Group involving 2.275 TB of stolen data and a $2 million demand, the 2025 ransomware‑as‑a‑service incident at Australian producer Natures Organics with 143 GB exfiltrated, and the 2024 encryption of the Royal Brighton Yacht Club’s systems after a compromised point‑of‑sale tool, which yielded over 94 GB of data and a $100,000 ransom demand.
Incidents
Attributed incidents are available to members.
27 incidentsSources
Sources available to members: 17 sources.