Medusa Ransomware: RaaS Escalating Double-Extortion Attacks on Critical Infra

Medusa emerged in June 2021 as a ransomware-as-a-service (RaaS) operation, distinct from the similarly named MedusaLocker and the Medusa mobile malware. It began as a closed variant, with a single group controlling development and operations, before adopting an affiliate model, though core functions such as ransom negotiation stayed centrally controlled by the developers.

The Medusa ransomware operation runs on double extortion: data is encrypted and simultaneously stolen, with threats to publish it on a dark-web leak site. Victims are typically given 48 hours to respond and can pay to add time to the countdown. Investigators also documented a triple-extortion twist, in which a victim who had already paid was approached again by a separate actor demanding further payment for a working decryptor. By early 2025, Medusa had grown into a serious critical-infrastructure threat, and as of August 2026 it was linked to more than 500 victims across healthcare, education, legal, insurance, technology, and manufacturing.

Its most notable recent chapter involves an affiliate tracked as Storm-1175. Assessed as financially motivated and China-linked, it stands apart by weaponizing internet-facing vulnerabilities at extreme speed. Since 2023 it has exploited more than 16 flaws across managed file transfer, mail, remote-access, and gateway products, including at least one as zero-day (CVE-2025-10035). In the fastest cases Storm-1175 moves from initial access to ransomware deployment within 24 hours, though most intrusions run five to six days.

Technically, Medusa operators blend living-off-the-land techniques with legitimate remote-monitoring software and tunneling utilities to move quietly, harvest credentials, and exfiltrate data to attacker-controlled cloud storage before deployment. The payload appends a .medusa extension, and the encryptor is designed to disable security tools and delete backups to frustrate recovery.

Medusa now exemplifies the convergence of criminal RaaS with state-adjacent exploit capability, its affiliate roster spanning both criminal and state-aligned actors. The core leak site has been quiet since mid-February 2026. Most recently the same affiliate was seen shifting away from Medusa toward a new strain, StormEncryptor, distinguished by a .encrypted extension and a different ransom-note name, after likely exploiting a remote-management authentication-bypass flaw (CVE-2026-18577). The pattern is a reminder that the Medusa platform and its operators keep evolving.