File · medusa · Crime · ransomware.live · refreshed 2026-10-06

medusa

sigil · no ATT&CK coverage stated

Analyst brief

ransomware.live

Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.

Take it with you

keyless · no signup

STIX 2.1 bundle ↓intrusion-set, techniques, malware, tools, relationships/actors/medusa/stix.json
JSON ↓the same record this page renders/api/v1/actors/medusa

References

1 source

1.ransomware.live

Track medusa on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.