Medusa Ransomware: Lazarus Group Targets US Healthcare — Defense and Hunting Guide

---
title: Potential Ransomware - Shadow Copy Deletion
id: 8a7f6b5c-3d2e-4a1b-9c0d-1e2f3a4b5c6d
description: Detects attempts to delete shadow copies using vssadmin, wmic, or PowerShell. This is a common tactic used by Medusa ransomware and other threat groups to prevent data recovery and facilitate double extortion.
status: experimental
author: Security Arsenal
date: 2026/04/06
references:
    - https://attack.mitre.org/techniques/T1485/
tags:
    - attack.impact
    - attack.t1485
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\vssadmin.exe'
            - '\wmic.exe'
    selection_cli:
        CommandLine|contains:
            - 'Delete Shadows'
            - 'shadowcopy delete'
    selection_pwsh:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'Win32_ShadowCopy'
            - '.Delete()'
    condition: 1 of selection*
falsepositives:
    - System administrators managing disk space (rare)
    - Legitimate backup scripts
level: high
---
title: Ransomware - Suspicious Exfiltration Tool Execution
id: 9b0g7c6d-4e3f-5b2c-0d1e-2f3g4h5i6j7k
description: Detects the execution of known data exfiltration tools such as rclone, which are frequently utilized by ransomware operators like Medusa (Lazarus Group) to steal sensitive healthcare data prior to encryption.
status: experimental
author: Security Arsenal
date: 2026/04/06
references:
    - https://attack.mitre.org/techniques/T1567/
tags:
    - attack.exfiltration
    - attack.t1567.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\rclone.exe'
            - '\mega.exe'
            - '\winscp.exe'
    condition: selection
falsepositives:
    - Legitimate administrator file transfers (uncommon in healthcare environments)
level: medium

// Hunt for Medusa/Lazarus Group TTP: Inhibit System Recovery (T1490)
// Detects VSS shadow copy deletion and recovery restriction attempts common to Medusa ransomware prep
// Focuses on script-based execution (PowerShell/CMD) using 'quiet' flags to avoid user detection
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("vssadmin.exe", "wmic.exe", "bcdedit.exe")
| where ProcessCommandLine has_any ("delete shadows", "shadowcopy delete", "recoveryenabled no", "ignoreallfailures yes")
| where ProcessCommandLine has_any ("/all", "/quiet")
| where InitiatingProcessFileName in~ ("powershell.exe", "cmd.exe", "rundll32.exe", "mshta.exe") or isempty(InitiatingProcessFileName)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA1
| order by Timestamp desc

name: Hunt.Medusa.Lazarus.Healthcare
description: |
  Hunts for Indicators of Compromise (IoC) and Tactics, Techniques, and Procedures (TTPs) 
  associated with the Medusa Ransomware operation attributed to the Lazarus Group 
  targeting the Healthcare sector.

parameters:
  - name: RansomNoteGlobs
    default: |
      C:\Users\*\Desktop\*RECOVER*.*
      C:\Users\*\Desktop\*README*.*
      C:\Users\*\Desktop\*MEDUSA*.*
      C:\*\!READ_ME*.*
      C:\*\HOW_TO_DECRYPT*.*

  - name: SuspiciousExtensions
    default: |
      .medusa
      .locked
      .mmda
      .enc

sources:
  - query: |
      -- HUNT 1: File System - Ransomware Notes and Encrypted Files
      -- Medusa ransomware typically drops a ransom note on the desktop or root drives.
      -- We also scan for recently created files with known Medusa extensions.
      
      LET file_matches = SELECT FullPath, Mtime, Atime, Size, Mode
      FROM glob(globs=RansomNoteGlobs)
      WHERE NOT IsDir
      
      LET encrypted_matches = SELECT FullPath, Mtime, Size
      FROM glob(globs="C:\\Users\\*\\*")
      WHERE parse_string(string=FullPath, regex="\\.([^.]+)$") in SuspiciousExtensions
        AND timestamp(epoch=Mtime) > now() - 7 * 24 * 3600 -- Last 7 days
      
      SELECT * FROM chain(file_matches, encrypted_matches)

  - query: |
      -- HUNT 2: Process Execution - Encryption and Defense Evasion
      -- Lazarus Group actors often use living-off-the-land binaries (LOLBins)
      -- like vssadmin, wmic, and bcdedit to disable recovery and delete shadow copies.
      
      SELECT Pid, Name, CommandLine, Exe, Username
      FROM pslist()
      WHERE Name IN ("vssadmin.exe", "wmic.exe", "bcdedit.exe", "wbadmin.exe")
        AND CommandLine =~ "(delete|shadowcopy|shutdown|recovery|nowinsafe)"

  - query: |
      -- HUNT 3: PowerShell - Obfuscated Command Execution
      -- Medusa/Lazarus commonly utilizes PowerShell for execution, often employing
      -- EncodedCommands or base64 strings to hide malicious payloads.
      
      SELECT Pid, Name, CommandLine, Parent.Pid AS ParentPid, Parent.Name AS ParentName
      FROM pslist()
      WHERE Name =~ "powershell"
        AND (
          CommandLine =~ "(DownloadString|IEX|FromBase64String|EncodedCommand)" OR
          CommandLine =~ "(-w hidden|-nop -noni -enc)"
        )

  - query: |
      -- HUNT 4: Network Connections - C2 and Exfiltration
      -- Identifies established connections from suspicious processes or locations.
      -- Checks for high-risk ports or binaries running from AppData (common persistence).
      
      SELECT Pid, RemoteAddress, RemotePort, State, 
             process.Name AS ProcName, process.Exe AS ProcPath, process.CommandLine
      FROM netstat()
      LEFT JOIN pslist() AS process ON Pid = process.Pid
      WHERE State =~ "ESTABLISHED"
        AND (
          process.Exe =~ "AppData" OR
          process.Name =~ "(powershell|cmd|python|wscript)" OR
          RemotePort IN (4444, 8443, 9999) -- Common C2 ports (Cobalt Strike / Custom)
        )
      GROUP BY Pid, RemoteAddress, RemotePort

<#
.SYNOPSIS
    Medusa Ransomware (Lazarus Group) - Defense and Hunting Script
.DESCRIPTION
    This script performs detection and hardening checks specific to the Medusa
    ransomware campaign by the Lazarus Group (targeting Healthcare).
    It checks for common IOCs, persistence mechanisms, and lateral movement vectors.
#>

# -----------------------------------------------------------------------------
# SECTION 1: Attack Surface Hardening (RDP & Lateral Movement)
# -----------------------------------------------------------------------------
# Medusa/Lazarus often exploits RDP vulnerabilities or valid accounts for initial access.
Write-Host "[$(Get-Date)] Checking RDP and Network Attack Surface..." -ForegroundColor Cyan

# Check if RDP is enabled (High risk vector)
$rdpProperty = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -ErrorAction SilentlyContinue
if ($rdpProperty.fDenyTSConnections -eq 0) {
    Write-Host "[!] WARNING: RDP is ENABLED. Ensure Network Level Authentication (NLA) is enforced and accounts are secure." -ForegroundColor Red
} else {
    Write-Host "[+] RDP is Disabled." -ForegroundColor Green
}

# Check for LAPS installation (Critical for preventing lateral movement)
$lapsInstalled = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Local Administrator Password Solution*" }
if (-not $lapsInstalled) {
    Write-Host "[!] WARNING: LAPS does not appear to be installed. Static local admin passwords facilitate Lazarus lateral movement." -ForegroundColor Yellow
} else {
    Write-Host "[+] LAPS appears to be installed." -ForegroundColor Green
}

# -----------------------------------------------------------------------------
# SECTION 2: IOC Hunt - Ransom Notes & Medusa Artifacts
# -----------------------------------------------------------------------------
# Medusa typically drops a readme file (often !!!READ_ME!!!.txt) and creates a wallpaper change.
Write-Host "[$(Get-Date)] Hunting for Medusa Ransom Notes and Payloads..." -ForegroundColor Cyan

# Define common Medusa ransom note names
$ransomNoteNames = @("README*.txt", "!!!READ_ME!!!*.txt", "HOW_TO_RECOVER*.txt", "restore_files_*.txt")

# Search user directories (recursive) for ransom notes
Get-ChildItem -Path "C:\Users\" -Recurse -Include $ransomNoteNames -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Host "[!] FOUND SUSPICIOUS FILE: $($_.FullName)" -ForegroundColor Red
    # Note: In a real incident, isolate the machine immediately.
}

# Check for the Medusa executable (often uses random names or masquerades)
# Medusa is known to run from AppData or Temp directories.
$suspiciousPaths = @("$env:APPDATA", "$env:TEMP")
$processList = Get-Process | Where-Object { $_.ProcessName -ne "svchost" -and $_.ProcessName -ne "explorer" }

Write-Host "[$(Get-Date)] Checking for processes running from user directories..." -ForegroundColor Cyan
foreach ($proc in $processList) {
    if ($proc.Path -like "$env:USERPROFILE*" -or $proc.Path -like "$env:APPDATA*") {
        Write-Host "[!] Suspicious Process running from user profile: $($proc.ProcessName) - Path: $($proc.Path)" -ForegroundColor Yellow
    }
}

# -----------------------------------------------------------------------------
# SECTION 3: Persistence Mechanisms (Scheduled Tasks & Registry)
# -----------------------------------------------------------------------------
# Lazarus groups frequently use Scheduled Tasks for persistence.
Write-Host "[$(Get-Date)] Auditing Scheduled Tasks for Persistence..." -ForegroundColor Cyan

$suspiciousTasks = Get-ScheduledTask | Where-Object { 
    $_.State -eq "Ready" -and 
    $_.TaskName -notmatch "Microsoft|Windows|Adobe|Google|Update" -and
    $_.Actions.Execute -like "*.exe*"
}

if ($suspiciousTasks) {
    Write-Host "[!] Found non-standard Scheduled Tasks (Investigate):" -ForegroundColor Yellow
    $suspiciousTasks | Select-Object TaskName, TaskPath, @{Name="Action";Expression={$_.Actions.Execute}} | Format-Table -AutoSize
}

# Check Registry Run Keys
Write-Host "[$(Get-Date)] Checking Registry Run Keys..." -ForegroundColor Cyan
$runPaths = @("HKLM:\Software\Microsoft\Windows\CurrentVersion\Run", 
              "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce", 
              "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", 
              "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce")

foreach ($path in $runPaths) {
    if (Test-Path $path) {
        Get-ItemProperty -Path $path -ErrorAction SilentlyContinue | Get-Member | Where-Object { $_.MemberType -eq "NoteProperty" } | ForEach-Object {
            $propName = $_.Name
            $propValue = (Get-ItemProperty -Path $path).$propName
            if ($propValue -like "*.exe*" -and $propValue -notlike "*Program Files*" -and $propValue -notlike "*Program Files (x86)*") {
                Write-Host "[!] Suspicious Run Key in $path : $propName = $propValue" -ForegroundColor Yellow
            }
        }
    }
}

# -----------------------------------------------------------------------------
# SECTION 4: Event Log Analysis (Defense Evasion & Encryption)
# -----------------------------------------------------------------------------
# Medusa aggressively stops services (SQL, Veeam, Backup) and deletes Shadow Copies.
Write-Host "[$(Get-Date)] Analyzing Security/System Logs for Medusa TTPs..." -ForegroundColor Cyan

# Check for VSSAdmin deletion (Event ID 4688 often captures the command line)
$events = Get-WinEvent -LogName Security -FilterXPath "*[System[(EventID=4688)]] and *[EventData[Data[@Name='CommandLine'] and (contains(text(),'vssadmin delete shadows') or contains(text(),'wmic shadowcopy delete'))]]" -ErrorAction SilentlyContinue -MaxEvents 5

if ($events) {
    Write-Host "[!] CRITICAL: Evidence of Shadow Copy deletion commands found in Security Logs!" -ForegroundColor Red
    $events | ForEach-Object { Write-Host "    Time: $($_.TimeCreated) - Command: $($_.Properties[8].Value)" }
}

# Check for Service Control Manager stops (Event ID 7036) stopping backup services
$serviceEvents = Get-WinEvent -LogName System -FilterXPath "*[System[(EventID=7036)]] and *[EventData[Data[@Name='param2'] and (contains(text(),'stopped'))]]" -ErrorAction SilentlyContinue -MaxEvents 20 | 
                 Where-Object { $_.Message -match "Veeam|SQL|Backup|ShadowCopy" }

if ($serviceEvents) {
    Write-Host "[!] WARNING: Recent stops detected on Backup/Database related services." -ForegroundColor Yellow
    $serviceEvents | Select-Object TimeCreated, Message | Format-Table -Wrap
}

Write-Host "[$(Get-Date)] Script completed. Review warnings for potential Medusa/Lazarus activity." -ForegroundColor Cyan