Medusa

Inactive

Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.

517 Victims

Jan 11, 2023 First Discovered

Feb 13, 2026 Last Discovered

215 Days Inactive

0% Infostealer

0/11 Sites Online

Known Locations (11)

62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid.onion

Human Verify

s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion

45.9.148.39

7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id.onion

Medusa Chat

medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd.onion

hupxs7ps7md24kpz4lwsbra64abgxjx3pcc2wuca5ibawf2g5hlpfyqd.onion

Human Verify

kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd.onion

503 Service Temporarily Unavailable

dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid.onion

Human Verify

cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd.onion

Human Verify

medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd.onion

Human Verify

xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion

Tools Used

CredentialTheft

Mimikatz

DefenseEvasion

EDRSandBlast, KillAV, ThrottleStop driver

DiscoveryEnum

Advanced IP Scanner, Navicat, PDQ Inventory, RoboCopy, SoftPerfect NetScan

Exfiltration

RClone

LOLBAS

BITSAdmin, Process Explorer, PsExec

Networking

Cloudflared, FRP, Ligolo, PuTTY, RevSocks

RMM-Tools

AnyDesk, Atera, HCL BigFix, N-Able, PDQ Deploy, ScreenConnect, SimpleHelp, Splashtop, eHorus

Intelligence

📄 2 Ransom Notes
View the actual ransom notes used by this group →

Victims (517)

Detailed victim list temporarily unavailable

This group has 517 victims. The victim list API is currently responding slowly for this dataset. Country, sector, and infostealer breakdowns are not available at this time. Basic stats (victim count, first/last seen) are shown above from a faster data source.