Medusa Ransomware Behavior Across the Attack Chain

Summary

Medusa is a Ransomware-as-a-Service (RaaS) operation that targets critical infrastructure through multiple affiliates. Its attack lifecycle commonly includes exploitation of public-facing vulnerabilities, credential theft, abuse of legitimate administrative tools, and data exfiltration before ransomware deployment. The group also uses malicious drivers to disable or impair security controls and evade detection.

Investigation

The report examines the Medusa attack lifecycle and shows how operators such as Storm-1175 and Lazarus Group use different initial access vectors. Investigations highlight exploitation of GoAnywhere MFT and BeyondTrust vulnerabilities, abuse of tunneling tools like Cloudflared, and deployment of the gaze.exe ransomware payload. Researchers also observed a consistent pattern of data exfiltration before encryption.

Mitigation

Organizations should prioritize patching vulnerabilities in internet-facing systems such as GoAnywhere MFT and BeyondTrust. Strict controls should be applied to RMM and tunneling software, while east-west administrative protocols including RDP, WMI, and SMB should be restricted. Maintaining offline, immutable backups and hardening deployment infrastructure such as PDQ Deploy are also essential.

Response

If suspicious Medusa activity is detected, analysts should identify the associated user account and reviewte sessions, and file transfers should be investigated for signs of intrusion. Responders should build a timeline around the affected host and identity to distinguish legitimate administration from coordinated malicious activity

Attack Flow

Detections

Possible Data Exfiltration over Rclone Tool

Short File Name

Using Certutil for Data Encoding and Cert Operations

Possible Mimikatz Arguments Detected

Possible Lateral Movement

Possible PsExec Usage

Suspicious Command and Control by Request to Out-of-Band Interactions Domain

Possible RCE Check

SOC Prime AI Rules
09 Sep 2026

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary has gained an initial foothold on the network and is looking to deploy ransomware across the domain. To maximize impact and ensure persistence, they aim to use “Living off the Land” techniques. The attacker will attempt to connect to the ADMIN$ share of a target machine from a remote workstation. This mimics the Medusa ransomware pattern of using administrative shares to drop malicious binaries and configuration files before executing them remotely.

• # Simulation Script: Mimic lateral movement via ADMIN$ share access
  $TargetComputer = "localhost" # In a real test, use a remote target IP/Hostname
  $AdminShare = "$TargetComputerADMIN$"
  
  Write-Host "[*] Attempting to connect to $AdminShare to trigger Event ID 5140..." -ForegroundColor Cyan
  
  try {
      # Testing connectivity to the administrative share
      if (Test-Path $AdminShare) {
          Write-Host "[+] Success: Connection to $AdminShare established. Check SIEM for Event 5140." -ForegroundColor Green
          # Simulate a small file write to mimic software distribution
          $testFile = "$AdminSharesimulation_test.txt"
          "Malicious Payload Simulation" | Out-File -FilePath $testFile
          Write-Host "[+] Simulated file write complete: $testFile" -ForegroundColor Green
      } else {
          Write-Error "[-] Failed to reach $AdminShare. Ensure administrative shares are enabled and permissions allow access."
      }
  } catch {
      Write-Error "[-] An error occurred: $_"
  }

• # Cleanup: Remove the simulated file and connection artifacts
  $TargetComputer = "localhost"
  $AdminShare = "$TargetComputerADMIN$"
  $testFile = "$AdminSharesimulation_test.txt"
  
  if (Test-Path $testFile) {
      Remove-Item -Path $testFile -Force
      Write-Host "[*] Cleanup: Removed $testFile" -ForegroundColor Yellow
  } else {
      Write-Host "[!] Cleanup: Test file not found, nothing to remove." -ForegroundColor Gray
  }