Medusa Ransomware: A Growing Threat

Summary

Medusa ransomware has seen a surge in attacks in early 2025, targeting over 40 victims and demanding ransoms up to $15 million. The group uses double extortion tactics, stealing data before encrypting systems, and often exploits vulnerabilities in Microsoft Exchange servers. Healthcare organizations are among those affected, raising concerns about patient data security.

Explore the data solution with built-in protection against ransomware TrueNAS.

** Main Story**

Alright, let’s talk Medusa ransomware. It’s definitely been making waves in 2025. And honestly, it’s a situation we need to be across.

In the first couple of months of this year alone, they’ve claimed responsibility for over 40 attacks. Which, when you think about it, is almost double what we saw in the same period last year. And if you compare it to 2023, there was a 42% increase from 2023 to 2024! Talk about a growth trajectory, right? Since they popped up in early 2023, they’ve listed nearly 400 victims on their data leak site. Though, I’m willing to bet the real number is even higher, you know, when you factor in the victims who just paid up to keep things quiet. The ransom demands? Anywhere from $100,000 all the way up to a cool $15 million! So yeah, they’re not messing around.

Interestingly, this surge is happening just as some of the other big names in the ransomware-as-a-service (RaaS) world, like BlackCat and LockBit, seem to be losing steam. Makes you wonder if Medusa is just stepping in to fill the void. Which is kinda worrying if you ask me.

How Medusa Operates: The Double Extortion Tactic

Medusa operates as RaaS, under a group tracked as Spearwing. So how do they work? Well, they’re all about “double extortion.” Basically, they steal sensitive data before they encrypt your whole network. Why? To really crank up the pressure. It’s like, pay us, or we leak all your dirty laundry. And if you call their bluff? They follow through. Remember that Minneapolis Public Schools case? Or those cancer centers and British high schools? All Medusa.

They’re also sneaky; really sneaky too. They like to use legitimate tools that are already on your network. You know, what’s called the “living-off-the-land” technique. It makes it harder to spot them, because they’re not introducing anything new. Then, they go after vulnerabilities in public-facing apps. Microsoft Exchange Servers are a favorite target. And lately, we are seeing a surge in the use of Initial Access Brokers (IABs). IABs basically break into orgnanizations and sell access to their networks to groups like Medusa. This makes them able to target multiple businesses at the same time, compounding the risk.

Healthcare: A Prime Target

Now, let’s talk healthcare. Unfortunately, they’ve become a major target for Medusa. Just in January 2025, they hit a US healthcare organization, infecting hundreds of machines. And Comparitech reported that Medusa was behind three out of seven healthcare ransomware attacks in February 2025. Two were in the US, one in the UK. It’s a scary trend, and shows no sign of slowing down.

These attacks have a long dwell time. What I mean by that is, the hackers spend days, even weeks lurking inside the network before they actually deploy the ransomware. That gives them time to find and steal all the really valuable data. The damage potential is insane.

Who’s at Risk? A Global Perspective

Medusa isn’t picky. They’ve hit organizations across healthcare, education, manufacturing, finance, government – you name it. And they’re all over the globe. The US, UK, Australia, Israel, India, Portugal, UAE… the list goes on.

And get this: that Summit Pathology Laboratories attack affected 1.8 million patients! Can you imagine the fallout from that? Some other targets include SimonMed Imaging, Bell Ambulance, and HCRG Care Group, just to give you an idea.

Fighting Back: It’s All About Being Proactive

So, what can you do? Well, the rise of Medusa really drives home the need for strong cybersecurity. First, patch those vulnerabilities, especially in those public-facing applications. Don’t leave the door open for them! Then, get some strong endpoint detection and response solutions in place. Also, train your employees. It can’t be emphasized enough. Because you can have all the tech in the world, but if someone clicks on a phishing link, you’re still vulnerable.

And of course, back up your data, regularly. It’s the oldest trick in the book, but it still works. You should also have a robust incident response plan ready to go. Because if—or when—an attack happens, you need to know exactly what to do. It sounds like a lot, I know, but, as Medusa and other ransomware groups keep getting more sophisticated, we can’t afford to let our guard down. And it can be a real challenge if you’re not a cybersecurity expert. You know, I was talking to my friend the other day, and she mentioned that the reason her company was hit was because their IT guy was just so run down that he missed a simple patch. So it can happen to anyone, really. So keep vigilant, my friends. It’s the only way.