Medusa Ransomware on the Rise: From Data Leaks to Multi-Extortion

Medusa ransomware operators have escalated activity since launching a public data‑leak site in Feb 2023, using multi‑extortion tactics (time extensions, paid deletions, data downloads) and targeting a broad range of industries; infections leverage exploitation of internet‑facing assets, web shells, legitimate RMM tools, living‑off‑the‑land techniques, and kernel drivers to disable security products, with an estimated ~74 victims across multiple countries.