Medusa Ransomware: 500+ Critical Infrastructure Breaches — Detection, Hunting, and Hardening Guide

The FBI and CISA have confirmed that the Medusa ransomware operation has compromised more than 500 U.S. critical infrastructure organizations since June 2021 — spanning healthcare, education, government, legal, insurance, technology, and manufacturing sectors. That victim count is not a projection or a telemetry estimate; it reflects confirmed breaches attributed to a ransomware-as-a-service (RaaS) operation that has been running at industrial scale for nearly five years.

If you operate in any critical infrastructure vertical, the operative assumption should be that Medusa affiliates have already probed your external attack surface. The group's playbook is well documented: exploit internet-facing applications and unpatched remote access infrastructure, phish for initial credentials, deploy legitimate RMM tooling for hands-on-keyboard access, move laterally with administrative deployment frameworks, and encrypt at scale while destroying recovery options. The 500+ figure matters because it demonstrates this is not opportunistic spray — it is a sustained, successful campaign against organizations that believed they were adequately defended.

This post breaks down Medusa's observed tradecraft from a defender's perspective and delivers production-ready Sigma, KQL, and Velociraptor detections, plus a hardening script you can run today.

Technical Analysis

Who and What Is Affected

• Target profile: U.S. critical infrastructure organizations across healthcare, education, legal, government, insurance, technology, and manufacturing sectors.
• Threat actor: Medusa ransomware-as-a-service operation (unrelated to Medusa Stealer, Medusa mobile banking malware, or the Medusa DDoS tool) active since June 2021, operating a data-leak site with double-extortion tactics.
• Scale: 500+ confirmed critical infrastructure victims per FBI/CISA reporting.

How the Attack Works

Medusa's intrusion lifecycle, per the CISA/FBI #StopRansomware advisory on Medusa and observed incident response engagements, follows a consistent pattern:

1. Initial access. Affiliates gain entry through phishing campaigns harvesting credentials and through exploitation of unpatched, internet-facing applications and remote access infrastructure. Exposed RDP and vulnerable externally facing services remain reliable entry vectors.
2. Living-off-the-land persistence and access. Medusa operators heavily abuse legitimate remote monitoring and management (RMM) tools — AnyDesk, ConnectWise ScreenConnect, Splashtop, Atera and similar — to blend into normal administrative traffic. This is the single most important behavioral pivot for defenders: the tooling is signed, widely deployed, and often whitelisted.
3. Lateral movement. Affiliates have been observed using PDQ Deploy and other legitimate software deployment frameworks to push tooling and the ransomware binary across the estate at scale — the same tooling your sysadmins use, pointed at destruction.
4. Defense evasion. Before encryption, operators disable or terminate endpoint security agents and kill services that would hold file locks (databases, backup agents, line-of-business applications).
5. Impact and recovery destruction. Medusa encrypts data using AES-256 with RSA-2048 key wrapping, appends the .MEDUSA extension, drops the ransom note !!!READ_ME_MEDUSA!!!.txt, and — critically — deletes volume shadow copies and disables recovery options via vssadmin, bcdedit, and wbadmin to prevent rapid restoration.
6. Double extortion. Stolen data is staged for leak-site publication to pressure payment.

Exploitation Status

This is a confirmed, actively operating campaign with 500+ attributed victims — not a theoretical threat. CISA has published a joint #StopRansomware advisory on Medusa (AA25-071A) with IOCs and mitigations. Organizations should treat detection content in that advisory and in this post as deploy-today material, and should cross-reference CISA's Known Exploited Vulnerabilities catalog for any unpatched internet-facing systems, as Medusa affiliates chain known CVEs against exposed services for initial access.

Detection & Response

The detections below target Medusa's most reliable behavioral fingerprints: recovery destruction, RMM abuse, mass deployment tooling, and the ransom note artifacts themselves. Every rule is built to fire on behavior, not just hash IOCs that rotate daily.

Sigma Rules

The following rules target (1) shadow copy and recovery destruction, (2) RMM tooling commonly abused by Medusa affiliates executing outside sanctioned paths or with suspicious parentage, and (3) creation of the Medusa ransom note.

---
title: Ransomware Recovery Destruction via Vssadmin Bcdedit or Wbadmin
id: 3f8c1a92-7b4e-4d51-9f2a-6c0e5d8b1a34
status: experimental
description: Detects deletion of volume shadow copies and disabling of boot recovery, a hallmark pre-encryption behavior of Medusa ransomware operators.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/02/20
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: windows
detection:
  selection_vss:
    Image|endswith:
      - '\vssadmin.exe'
      - '\wmic.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'shadowcopy delete'
      - 'resize shadowstorage'
  selection_bcd:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  condition: 1 of selection_*
falsepositives:
  - Backup administrators resizing shadow storage during maintenance windows
  - Veeam or backup product scripts (correlate with service accounts and scheduled tasks)
level: high
---
title: Suspicious RMM Tool Execution Associated With Medusa Intrusions
id: 8d2e4b17-3a6f-4c95-8e1d-9b7a2c4f6e58
status: experimental
description: Detects execution of RMM tooling (AnyDesk, ScreenConnect, Splashtop, Atera) from non-standard paths or with Office/script parent processes, consistent with Medusa affiliate tradecraft.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/02/20
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\anydesk.exe'
      - '\screenconnect.clientservice.exe'
      - '\screenconnect.client.exe'
      - '\splashtop.exe'
      - '\sr_manager.exe'
      - '\atera_agent.exe'
      - '\pdqdeployconsole.exe'
      - '\pdqinventoryconsole.exe'
  filter_standard_path:
    Image|startswith:
      - 'C:\Program Files\AnyDesk\'
      - 'C:\Program Files (x86)\AnyDesk\'
      - 'C:\Program Files\ScreenConnect Client'
      - 'C:\Program Files (x86)\ScreenConnect Client'
      - 'C:\Program Files\ATERA Networks\'
  condition: selection_tool and not 1 of filter_standard_path
falsepositives:
  - Portable RMM versions used by sanctioned IT staff (baseline authorized RMM paths first)
level: high
---
title: Medusa Ransomware Ransom Note Creation
id: 5b7f9e03-1d48-4a62-b3c7-2e9f6a1d8c45
status: experimental
description: Detects creation of the Medusa ransomware ransom note filename on endpoint file systems.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
  - https://attack.mitre.org/techniques/T1486/
author: Security Arsenal
date: 2026/02/20
tags:
  - attack.impact
  - attack.t1486
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|contains:
      - '!!!READ_ME_MEDUSA!!!'
      - 'READ_ME_MEDUSA'
  condition: selection
falsepositives:
  - Security team canary files or deception artifacts
level: critical

Tuning guidance: Rule 2 will be noisy until you baseline sanctioned RMM paths. That baseline exercise is not optional hygiene — inventory every RMM product legitimately in your environment, and alert on anything outside that list, full stop. Unauthorized RMM is one of the highest-fidelity intrusion signals available in modern environments.

KQL — Microsoft Sentinel / Defender

This hunt query surfaces the Medusa pre-encryption sequence: recovery destruction, security tool tampering, and PDQ Deploy-style mass distribution, correlated at the device level within a 30-minute window — the compression of these events in time is what separates an intrusion from routine admin work.

let lookback = 14d;
let ImpactEvents = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where (ProcessCommandLine has_any ('delete shadows', 'shadowcopy delete', 'resize shadowstorage')
     and FileName in~ ('vssadmin.exe', 'wmic.exe'))
    or (FileName =~ 'bcdedit.exe' and ProcessCommandLine has_any ('recoveryenabled no', 'bootstatuspolicy ignoreallfailures'))
    or (FileName =~ 'wbadmin.exe' and ProcessCommandLine has 'delete catalog')
| project ImpactTime=TimeGenerated, DeviceId, DeviceName, ImpactCmd=ProcessCommandLine, ImpactAccount=InitiatingProcessAccountName;
let RMMEvents = DeviceProcessEvents
| where TimeGenerated > ago(lookback)
| where FileName has_any ('anydesk', 'screenconnect', 'splashtop', 'atera', 'pdqdeploy', 'pdqinventory')
| project RMMTime=TimeGenerated, DeviceId, RMMTool=FileName, RMMPath=FolderPath, RMMAccount=InitiatingProcessAccountName;
ImpactEvents
| join kind=inner RMMEvents on DeviceId
| where abs(datetime_diff('minute', ImpactTime, RMMTime)) <= 30
| project DeviceName, ImpactAccount, ImpactCmd, ImpactTime, RMMTool, RMMPath, RMMTime
| sort by ImpactTime desc

A companion query for file-level artifacts — the ransom note and .MEDUSA extension mass-renames:

DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FileName has 'READ_ME_MEDUSA'
    or FolderPath endswith '.MEDUSA'
| summarize NoteCount = countif(FileName has 'READ_ME_MEDUSA'),
            EncryptedFileCount = countif(FolderPath endswith '.MEDUSA'),
            FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
            by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath
| where EncryptedFileCount > 50 or NoteCount > 0
| sort by EncryptedFileCount desc

The EncryptedFileCount > 50 threshold isolates mass-encryption behavior from one-off file renames; a single ransom note hit is already a critical finding on its own.

Velociraptor VQL

For endpoint forensics and fleet-wide hunting, this artifact sweeps for Medusa ransom notes and recently renamed .MEDUSA files, then correlates with suspicious process execution:

-- Hunt for Medusa ransomware artifacts: ransom notes, encrypted file extensions, suspicious processes
SELECT {
    SELECT FullPath, Size, Mtime
    FROM glob(globs='C:\Users\*\**\*READ_ME_MEDUSA*', accessor='ntfs')
} AS RansomNotes,
{
    SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
    FROM pslist()
    WHERE CommandLine =~ '(?i)(delete shadows|shadowcopy delete|recoveryenabled no|ignoreallfailures|delete catalog)'
       OR Name =~ '(?i)(anydesk|screenconnect|splashtop|atera|pdqdeploy)'
} AS SuspiciousProcesses,
{
    SELECT FullPath, Mtime
    FROM glob(globs='D:\**\*.MEDUSA', accessor='ntfs')
    LIMIT 100
} AS EncryptedFiles
FROM scope()

Deploy this as a hunt across critical servers and VDI infrastructure first — Medusa operators prioritize file servers and shared infrastructure for maximum business impact.

Remediation / Hardening Script

Run this PowerShell audit on Windows servers and representative endpoints to assess your exposure to Medusa's tradecraft: shadow copy configuration, unauthorized RMM presence, RDP exposure, and LAPS/safe-mode hardening gaps.

# Medusa Ransomware Exposure Audit - Security Arsenal
# Run elevated. Outputs findings to console and C:\Windows\Temp\MedusaAudit.log

$LogFile = 'C:\Windows\Temp\MedusaAudit.log'
function Write-Finding($Severity, $Message) {
    $line = "[{0}] [{1}] {2}" -f (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'), $Severity, $Message
    Write-Host $line
    Add-Content -Path $LogFile -Value $line
}

# 1. Verify VSS protection state and recent shadow deletions
$shadows = vssadmin list shadows 2>$null
if ($shadows -match 'No items found') { Write-Finding 'WARN' 'No shadow copies present - verify backup strategy does not rely on VSS alone.' }
$vssEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='volsnap'; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue
if ($vssEvents | Where-Object { $_.Message -match 'deleted' }) { Write-Finding 'HIGH' 'Shadow copy deletion events found in last 14 days - investigate immediately.' }

# 2. Detect unauthorized RMM tooling (baseline this list for your environment)
$SuspiciousRMM = @('anydesk.exe','screenconnect.clientservice.exe','splashtop.exe','atera_agent.exe','pdqdeployconsole.exe')
$found = Get-ChildItem -Path 'C:\Program Files','C:\Program Files (x86)','C:\Users' -Recurse -ErrorAction SilentlyContinue -Include $SuspiciousRMM | Select-Object -First 50
foreach ($f in $found) { Write-Finding 'HIGH' "RMM tool found: $($f.FullName) - confirm it is sanctioned by IT." }

# 3. Check RDP exposure
$rdpEnabled = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 0
$nla = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -ErrorAction SilentlyContinue).UserAuthentication
if ($rdpEnabled -and $nla -ne 1) { Write-Finding 'HIGH' 'RDP enabled WITHOUT Network Level Authentication - enable NLA or disable RDP.' }
elseif ($rdpEnabled) { Write-Finding 'INFO' 'RDP enabled with NLA - ensure it is not internet-exposed (check perimeter firewall). }

# 4. Verify SMBv1 is disabled (legacy lateral movement vector)
$smbv1 = Get-SmbServerConfiguration | Select-Object -ExpandProperty EnableSMB1Protocol
if ($smbv1) { Write-Finding 'HIGH' 'SMBv1 ENABLED - disable with: Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force' }

# 5. Check LSA protection and credential guard posture
$lsa = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -ErrorAction SilentlyContinue).RunAsPPL
if ($lsa -ne 1) { Write-Finding 'MEDIUM' 'LSA Protection (RunAsPPL) not enabled - credential dumping resistance is degraded.' }

# 6. Confirm tamper protection on Defender (if applicable)
$tp = Get-MpComputerStatus -ErrorAction SilentlyContinue
if ($tp -and -not $tp.IsTamperProtected) { Write-Finding 'HIGH' 'Defender Tamper Protection is OFF - ransomware operators can disable AV unimpeded.' }

Write-Finding 'INFO' 'Audit complete. Review all HIGH findings within 24 hours.'

Remediation

Medusa's success at 500+ organizations is a story of unpatched perimeter systems, unsanctioned remote access tooling, and insufficient segmentation — all remediable problems.

Immediate (0-72 hours):

1. Patch internet-facing infrastructure. Audit every externally exposed application, VPN concentrator, and remote access service against the CISA KEV catalog and vendor advisories. Medusa affiliates chain known vulnerabilities — if it is in KEV and it faces the internet, it is an entry point. CISA Binding Operational Directive 22-01 deadlines apply to federal civilian agencies; private critical infrastructure should adopt the same timelines as internal policy.
2. Inventory and restrict RMM tooling. Enumerate every authorized remote access product, block all others at the EDR and proxy layer, and alert on unauthorized installation. Treat any unapproved RMM binary as an incident until proven otherwise.
3. Kill exposed RDP. No RDP on the public internet, period. Enforce NLA, MFA via gateway, and restrict to management VLANs.
4. Deploy the detections above and pull the IOCs from the CISA #StopRansomware: Medusa advisory (AA25-071A) into your blocklists.

Short term (1-4 weeks):

5. Segment ruthlessly. Medusa's use of PDQ Deploy succeeds because flat networks let a single admin-context foothold touch everything. Enforce tiered administration, deny workstation-to-workstation SMB/RPC, and isolate backup infrastructure from domain authentication entirely.
6. Harden backups against deletion. Immutable/offline backups (WORM storage or physically isolated copies), separate credentials, and regularly tested restoration. If vssadmin delete shadows and wbadmin delete catalog can destroy your recovery posture, the posture was already broken.
7. Enable tamper protection and LSA protection fleet-wide; verify with the audit script above.
8. Phishing-resistant MFA on all remote access, email, and privileged accounts — phishing remains a top Medusa initial access vector.

Strategic:

9. Tabletop the Medusa scenario. Given the confirmed targeting of critical infrastructure, run an IR exercise assuming double extortion — encryption plus leak-site publication — and validate your decision tree for legal, regulatory (including sector-specific notification obligations), and communications response.
10. Monitor for data staging. Egress monitoring for large archive creation and unusual outbound transfer volumes catches the extortion half of the operation before the encryption half begins.

The 500-organization figure is the lesson: Medusa is not sophisticated because of novel exploits — it is effective because of disciplined execution against common defensive gaps. Close the gaps, deploy the detections, and verify your backups restore.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub