Ransomware Group
Medusa
Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.
Known victims517
Threat level
CRITICAL
Get an alert if one of your domains is named on a ransomware leak site.
Monitor your domainsFree account · up to 5 monitored targets
Tactics, Techniques & Procedures (TTPs)
CredentialTheft
- Mimikatz
DefenseEvasion
- EDRSandBlast
- KillAV
- ThrottleStop driver
DiscoveryEnum
- Advanced IP Scanner
- Navicat
- PDQ Inventory
- RoboCopy
- SoftPerfect NetScan
Exfiltration
- RClone
LOLBAS
- BITSAdmin
- Process Explorer
- PsExec
Networking
- Cloudflared
- FRP
- Ligolo
- PuTTY
- RevSocks
RMM-Tools
- AnyDesk
- Atera
- HCL BigFix
- N-Able
- PDQ Deploy
- +4 more
Known infrastructure
The following Tor hidden services have been associated with this group:
Human Verify7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id.onionHuman Verify45.9.148.39503 Service Temporarily Unavailable
These sites are malicious. Open them only from an isolated environment.
Check if you’re affected
Look up your domain to see whether it appears on Medusa’s victim list.
Try it nowFree⌘K
Try
risk score · threat categories · sources · age · confidence — in one request