Metatron AI Online. Pristine.

EYES ONLY — FBI Law Enforcement Coordination

MEDUSA

Ransomware

A woman with living snakes. Cover art for the Medusa RaaS briefing — 500+ U.S. critical infrastructure victims, Storm-1175 at high tempo.

v2026-09-10E/2026-09-10
Enter briefing
Medusa, a woman with living snakes for hair, in a ruined temple
Cover · Medusa, a woman with snakes

Section 01 · Executive summary

Ransomware-as-a-Service. High tempo. Broker-fed.

Medusa is a Ransomware-as-a-Service operation. Since first identified in June 2021, it has breached more than 500 U.S. critical infrastructure organizations as of April 2026. Its primary affiliate — Storm-1175 (Microsoft tracking, Chinese nexus, active since at least July 2024) — operates at high tempo. In some cases, from successful exploitation to data theft and ransomware deployment in under 24 hours.

Medusa's climb from 300 to 500+ victims tracks broker supply, not a leap in Medusa's own tradecraft.

Confirmed U.S. victims

500+

Critical infrastructure

Leak-site victims

517

Tracked as of 17 Aug 2026

Ransom range

$100K–$15M

Per incident

IAB payments

$100–$1M

Initial access brokers

Response window

48 hours

Victim countdown

Timer extension

$10K / day

Cryptocurrency

Section 02 · Threat actor

Storm-1175

Medusa's primary affiliate

Tracking
Storm-1175 (Microsoft)
Attribution
Chinese nexus, financially motivated cybercriminal group
Active since
At least July 2024
Operating model
Medusa RaaS affiliate
Core characteristic
Rapid weaponization of N-day and 0-day vulnerabilities during the patch gap
CVEs exploited
16+ distinct CVEs since 2023

24-hour blitz

The group focuses on N-day vulnerabilities, often completing attacks within days. SAP NetWeaver (CVE-2025-31324) was disclosed on April 24, 2025 — Storm-1175 used it to launch Medusa ransomware the next day. They completed an attack on SmarterMail (CVE-2026-23760) a full week before public disclosure.

IAB economic model

Medusa developers recruit Initial Access Brokers on cybercriminal forums, offering $100 to $1,000,000 USD for exclusive Medusa work. Most IABs work for multiple ransomware variants. What they sell is a ready-made foothold — affiliates skip the work of identifying and breaching a target.

Section 03 · Complete IOC matrix

Indicators of compromise

CISA AA25-071A (updated 18 Aug 2026), Gurucul, Darktrace, Yazoul. Block, hunt, and import into threat-intel platforms.

CISA advisory — updated 18 Aug 2026

  • 143.244.47.89

    C2 infrastructure

  • 167.88.166.173

    C2 infrastructure

  • 143.110.243.154

    C2 (erp.ranasons.com)

  • 185.238.231.16

    C2 infrastructure

  • 23.234.89.195

    C2 infrastructure

  • 146.70.172.247

    C2 infrastructure

  • 155.2.215.71

    C2 infrastructure

  • 23.234.106.242

    C2 infrastructure

  • 23.234.93.112

    C2 infrastructure

  • 37.19.21.180

    C2 infrastructure

  • 155.2.215.69

    C2 infrastructure

  • 185.238.231.98

    C2 infrastructure

  • 37.221.66.239

    C2 infrastructure

  • 185.135.86.185

    C2 infrastructure

  • 83.138.53.139

    C2 infrastructure

  • 185.238.231.4

    C2 infrastructure

  • 185.238.231.77

    C2 infrastructure

  • 185.238.231.85

    C2 infrastructure

  • 85.155.186.121

    C2 infrastructure

  • 94.156.67.145

    C2 infrastructure

Darktrace / Gurucul research

  • 185.108.129.62

    RMM abuse infrastructure

  • 185.126.238.119

    RMM abuse infrastructure

  • 213.183.63.41

    Related infrastructure

  • 213.183.63.42

    Related infrastructure

  • 31.220.45.120

    Related infrastructure

  • 91.92.246.110

    Related infrastructure

  • 45.9.149.112

    Related infrastructure

  • 89.36.161.12

    Related infrastructure

  • 193.37.69.154

    Related infrastructure

Malware distribution & leak-site IP

  • 45.61.150.94:8000

    Malware download (storm.exe)

  • 95.213.145.101:8000

    Distribution (64ME_bul1.exe)

  • 62.182.158.226

    Malware distribution

  • 95.143.191.148

    Tor leak-site real IP (Saint Petersburg)

Section 04 · MITRE ATT&CK

TTP matrix

Initial Access

  • T1566PhishingAffiliates steal credentials
  • T1190Exploit Public-Facing ApplicationUnpatched internet-facing software
  • T1078Valid AccountsPurchased access via IABs
  • T1133External Remote ServicesRDP

Discovery

  • T1135Network Share DiscoveryQuery shared drives for information sources
  • T1136.002Domain Account CreationBackdoor domain accounts for persistence

Defense Evasion

  • T1068BYOVD — ABYSSWORKERSigned driver smuol.sys masquerading as CrowdStrike Falcon; disables EDR
  • T1027PowerShell ObfuscationBase64, string slicing, gzip for in-memory execution
  • T1070.003Clear Command HistoryDeletes PowerShell command-line history
  • T1490Volume Shadow Copy DeletionDeletes shadow copies before encryption

Credential Access

  • T1003.001LSASS Memory DumpMimikatz and comsvcs.dll Minidump
  • T1003.003ntds.dit TheftVia Volume Shadow Copy to forge Kerberos tickets
  • —ImpacketCredential dumping

Lateral Movement

  • T1021.002SMB / Windows Admin SharesPsExec and native Windows tools
  • T1021.001RDPRemote Desktop Protocol
  • —RMM Tool AbuseAnyDesk, ConnectWise ScreenConnect, SimpleHelp, MeshAgent

Exfiltration

  • —RcloneLarge-scale data theft to Medusa C2
  • —BandizipFile packaging
  • —RoboCopyAlternative exfiltration

Impact

  • T1486Data Encrypted for Impactgaze.exe uses AES-256, .medusa extension
  • —Double / Triple ExtortionTor leak site + publication threats + direct contact

Section 05 · Exploited vulnerabilities

Sixteen plus distinct CVEs

Storm-1175 has exploited more than 16 distinct vulnerabilities since 2023, including multiple cases where they weaponized 0-days before public disclosure.

CVEProductTypeSpeed
CVE-2024-1709ConnectWise ScreenConnectAuthentication bypass—
CVE-2023-48788Fortinet EMSSQL injection—
CVE-2025-10035Fortra GoAnywhere MFTDeserializationOctober 2025
CVE-2025-31324SAP NetWeaverRemote code executionExploited the next day
CVE-2026-23760SmarterTools SmarterMailAuthentication bypassExploited one week before disclosure (0-day)
CVE-2023-27351PaperCut——
CVE-2024-27198JetBrains TeamCity——
CVE-2024-57726/27/28SimpleHelpMultiple—
BeyondTrustBeyondTrustOS command injectionAdded August 2026

Section 06 · Tool inventory

What they bring

  • AnyDesk

    RMM persistence and lateral movement

  • ConnectWise ScreenConnect

    Covert lateral movement

  • SimpleHelp

    RMM persistence

  • MeshAgent

    C2 and persistence

  • PDQ Deployer

    Mass ransomware deployment

  • PDQ Inventory

    Asset discovery

  • Rclone

    Large-scale data theft

  • Bandizip

    File packaging

  • RoboCopy

    Alternative exfiltration

  • KillAVDriver / KillAV

    EDR / AV disabling

  • Navicat

    Database access

  • NetScan

    Network scanning

  • CertUtil

    File download / decode

  • Nezha

    C2 tool

  • GSocket

    C2 tool

  • Mimikatz

    Credential dumping

  • comsvcs.dll Minidump

    LSASS dump

  • Impacket

    Credential dumping

  • ABYSSWORKER (smuol.sys)

    BYOVD driver, disables EDR

Section 07 · Law enforcement

Action recommendations

The IAB economic model is the core weakness of Medusa's operation. Disrupting broker supply is more effective than chasing individual affiliates.

  1. 01

    Forum and marketplace monitoring

    Medusa developers recruit IABs on cybercriminal platforms, offering $100 to $1,000,000. Monitoring advertisements and transactions disrupts the supply chain.

  2. 02

    IAB payment tracking

    IABs receive cryptocurrency. Work with blockchain analytics to track flows associated with Medusa brokers.

  3. 03

    Multi-variant IAB identification

    Most IABs work for multiple ransomware families. Identifying multi-variant brokers can disrupt several operations at once.

  4. 04

    Tor leak-site monitoring

    Track new victim postings on the primary .onion, attempt deanonymization follow-up (real IP 95.143.191.148, Saint Petersburg), notify victims before publication, and watch Tox / Tor chat during the 48-hour window.

  5. 05

    Victim data protection

    Paying does not guarantee data will not be published. Medusa uses double or triple extortion. The leak site countdown can be extended for $10,000/day. Payment is not recommended.

Immediate action items

  1. Import the IOC list into law enforcement threat intelligence platforms.
  2. Monitor the Medusa Tor leak site to identify new victims.
  3. Track IAB cryptocurrency payments to disrupt the supply chain.
  4. Distribute the defender checklist to critical infrastructure organizations.

Execute. Adapt. Protect.

Section 08 · Defender response

Quick-response checklist

Marks persist on this device. Work the P0 items in the first 24 hours.

Immediate — 0 to 24 hours

Short-term — 24 to 72 hours

YARA

rule Medusa_ABYSSWORKER_Driver {
    meta:
        description = "Detects ABYSSWORKER malicious driver used by Medusa"
        reference = "CISA AA25-071A"
    strings:
        $s1 = "smuol.sys" wide ascii
        $s2 = "ABYSSWORKER" wide ascii
        $s3 = "CrowdStrike" wide ascii
    condition:
        any of them
}

rule Medusa_Ransomware_gaze {
    meta:
        description = "Detects Medusa gaze.exe encryptor"
        reference = "CISA AA25-071A"
    strings:
        $s1 = "gaze.exe" wide ascii
        $s2 = "!!!READ_ME_MEDUSA!!!" wide ascii
        $s3 = ".medusa" wide ascii
    condition:
        any of them
}

Sigma

title: Medusa - PowerShell History Clear
id: medusa-ps-history
status: experimental
logsource:
    product: windows
    service: powershell
detection:
    selection:
        EventID: 4104
        ScriptBlockText|contains:
            - "Clear-History"
            - "Remove-Item"
            - "Set-PSReadlineOption"
    condition: selection