Medusa Rides Momentum From Ransomware-as-a-Service Pivot

Medusa (Spearwing) shifted to a ransomware-as-a-service model in mid-2024, driving a ~43% year-over-year increase in attacks and compromising roughly 300–400 victims—often in critical industries—while leveraging living-off-the-land techniques and a BYOVD (bring-your-own-vulnerable-driver) that mimics a CrowdStrike signature to evade defenses; U.S. agencies and multiple security firms have issued warnings and recommend layered visibility across endpoints, networks, and cloud resources.