RANSOMWARE FAMILY
Medusa
Medusa is a ransomware-as-a-service operation that runs a public leak site to pressure victims into paying, and has frequently targeted healthcare, education and government organisations alongside private businesses.
What to look for
- Encrypted files commonly given a ".medusa" extension
- A ransom note often named along the lines of "!!!READ_ME_MEDUSA!!!.txt"
- A public leak site used to publish stolen data on a countdown timer
- Attacks disproportionately affecting healthcare and education organisations
Recovery approach
Medusa's leak-site countdown is designed to pressure a fast payment — it doesn't change our assessment, and getting a proper read on what's recoverable still comes first.
OTHER FAMILIES WE SEE
Also covered
Ryuk
An older but historically significant family, often deployed as the final stage of a wider malware infection.
What to look for →LockBit
One of the most widespread ransomware-as-a-service operations, active against organisations worldwide.
What to look for →Akira
A newer group known for exploiting VPN and remote-access weaknesses to gain entry.
What to look for →BlackCat / ALPHV
A Rust-based ransomware-as-a-service operation linked to a number of high-profile incidents.
What to look for →