Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Medusa Ransomware Turning Your Files into Stone

Summary: Unit 42 analysts report that Medusa ransomware, a RaaS platform that surfaced in late 2022 and targets Windows environments, escalated in early 2023 with a TOR leak site called the Medusa Blog and a public Telegram channel named "information support" used to publish stolen data. Based on its leak site, Medusa possibly impacted 74 organizations worldwide in 2023, with 24 incidents in the United States and the most affected sectors being high technology, education and manufacturing.

Why it matters: Medusa's operators pair extortion with living-off-the-land techniques and kernel drivers built to terminate or delete endpoint security products by name, so the tools defenders rely on may be the first thing removed on an infected host.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026