Medusa is a ransomware-as-a-service operation that has affected hundreds of organisations across sectors including education, healthcare and government, prompting US government advisories.

Key facts

• Runs a RaaS model with a public leak site and a Telegram presence used to pressure victims.
• Gains access through phishing and exploitation of unpatched, internet-facing services.
• Uses double extortion, sometimes with additional demands after payment.
• Subject of a 2025 CISA/FBI advisory detailing its techniques and indicators.

Why it matters

Medusa relies on exposed services and stolen credentials. Surfacing those weaknesses early is the most reliable way to prevent an intrusion.

How DarkThreatX helps

DarkThreatX monitors dark web leak sites, forums and marketplaces for activity and data tied to your organisation, so you can respond before exposure becomes a breach. Run a free dark web scan or explore the platform.