Medusa Ransomware Decryption & Data Recovery

Medusa was first identified in June 2021, initially run end-to-end by a single crew. Around 2023 it moved to a RaaS model, bringing in affiliates and initial access brokers, and volume grew accordingly. Symantec tracks the operators as Spearwing. CISA, the FBI and MS-ISAC published the #StopRansomware advisory AA25-071A in March 2025, with subsequent updates as new vulnerabilities entered its toolkit.

Its most distinctive trait is productised coercion. Medusa runs a .onion leak site called Medusa Blog, posting a public countdown for each victim and listing priced options openly: extend the countdown, delete the data specifically, or buy the data outright. The advisory also records ransom demands posted with direct links to affiliated cryptocurrency wallets. Beyond encryption and leak pressure, public reporting has documented triple-extortion cases in which a victim that had already paid was approached again by someone claiming to be a Medusa member, alleging the negotiator had pocketed the funds. The negative lesson is unambiguous: payment guarantees nothing.

By sector, Medusa spans healthcare, education, manufacturing, government, information technology, legal and insurance, with healthcare and public health specifically named as frequent victims. Targets range from small firms to large institutions running full virtualisation stacks.

For organisations in the region, the instructive part is its choice of entry points: Medusa repeatedly exploits remote-management and file-transfer components — ScreenConnect, Fortinet EMS, Fortra GoAnywhere, BeyondTrust and similar. These systems are often maintained by outsourced IT or MSPs, patched late, exposed to the internet, and inherently privileged, so a single break reaches the core of the network. Rather than memorising family names, it is far more useful to bring the versions and exposure of such operations-channel systems into routine inspection.

Extension. Encrypted files uniformly gain .MEDUSA (lowercase .medusa in some builds). It is the most direct marker, but must be distinguished from MedusaLocker, which commonly uses .encrypted, .dever or .lockfilesKR — different family, different handling and recovery path.

Ransom note. The filename is consistently !!!READ_ME_MEDUSA!!!.txt, instructing victims to make contact within 48 hours via Tor live chat or Tox, with a link to the leak site and an explanation of the countdown. That combination — fixed note name, 48 hours, Tox — is a reliable identifier.

Host-side artefacts.

• Volume shadow copies deleted via vssadmin.
• Heavy living-off-the-land use: PowerShell, certutil, bitsadmin, PsExec, WMI and RDP for lateral movement.
• Persistence through legitimate remote tools (AnyDesk, Atera, Splashtop, ConnectWise and others).
• EDR disabled via bring-your-own-vulnerable-driver, with published analyses documenting signed drivers named to resemble well-known security vendors' drivers.
• Windows event logs cleared and firewall rules modified to permit RDP.

Leak-site signature. Victims appear on Medusa Blog with a public countdown and openly priced options to extend, delete or purchase the data. Seeing that pricing structure on a leak site effectively confirms the family.

Virtualisation artefacts. Bulk power-off of guests on ESXi/vCenter, encryption of datastore files, and recursive encryption of network shares.

Medusa's entry points reduce to two lines: buy the account or break the operations channel.

1. Initial access brokers and phishing. The advisory records Medusa purchasing ready-made access from IABs alongside credential-stealing phishing. Many victims therefore had credentials circulating on underground markets long before encryption.

2. Remote-management and file-transfer component flaws — Medusa's signature vector:

• CVE-2024-1709: ConnectWise ScreenConnect authentication bypass;
• CVE-2023-48788: Fortinet FortiClient EMS SQL injection;
• CVE-2025-10035: Fortra GoAnywhere MFT deserialisation flaw;
• CVE-2026-1731: BeyondTrust remote code execution;
• CVE-2026-23760: SmarterTools SmarterMail authentication bypass, exploited as a zero-day — Microsoft attributed it to Medusa affiliate Storm-1175 in April 2026.

Timing matters too: Storm-1175 was exploiting GoAnywhere CVE-2025-10035 more than a week before the patch existed, so waiting for a vendor advisory and then scheduling the fix does not close this class of entry point.

These systems share a profile: permanently internet-facing, inherently privileged across hosts, and treated internally as operations infrastructure rather than business systems, so patching is deprioritised. Medusa bets on that repeatedly.

3. Weak credentials and RDP/VPN without MFA, combined with accounts stolen from browsers and credential stores for lateral movement.

Inside the network: rely on LOLBins (PowerShell, certutil, bitsadmin, WMI) to minimise custom tooling on disk; establish redundant channels through legitimate remote software; disable EDR via BYOVD; enumerate and destroy backups and delete shadow copies; exfiltrate; then deploy the encryptor in bulk outside business hours via PsExec, scheduled tasks or Group Policy, covering ESXi and network shares.

Because so much of this uses built-in tooling, Medusa's pre-encryption activity often reads as routine administration in conventional alerting — which is why it is frequently discovered only when files start changing.

Algorithms. AES-256 for file content with RSA for key exchange and wrapping. Key material is recoverable only by the operators, and no exploitable weakness exists on the ciphertext side.

Scope of encryption. Local disks, mapped network drives, reachable SMB/NFS shares and NAS directories, and virtual-machine files on ESXi datastores. Large files are typically partially encrypted for speed, and the coverage strategy and ratio vary by build and parameters and must be measured per case — which is exactly what determines how much usable original data remains inside VMDKs and database files.

Destruction and anti-forensics.

• Deletes volume shadow copies with vssadmin, cutting the easiest local rollback.
• Stops and disables database, mail, backup-agent and security services.
• Loads vulnerable signed drivers via BYOVD to disable EDR.
• Clears Windows event logs and modifies firewall rules to permit RDP.
• Leans on built-in tooling (LOLBins) to minimise detectable artefacts on disk.

Extortion model.

• The note demands contact within 48 hours; after that the victim is published on Medusa Blog with a countdown.
• The countdown can be extended for a fee priced per day, alongside listed options to have the data deleted specifically or purchased outright.
• Triple extortion is publicly documented: victims who had already paid were approached again by someone claiming to be an accomplice.

In Medusa cases, therefore, payment not only fails to guarantee decryption or deletion — it can invite a second demand. That needs saying plainly to decision-makers when the response strategy is set.