Security Scorecard Medusa Ransomware January 2024

Medusa Ransomware has leveraged an encoded list of services that it designates for termination.

Medusa Ransomware has utilized XOR encrypted strings.

Medusa Ransomware has utilized an encoded list of the processes that it detects and terminates.

Medusa Ransomware has launched PowerShell scripts for execution and defense evasion.

Medusa Ransomware has used `cmd.exe` to execute command on an infected host.

Medusa Ransomware has the ability to delete itself after execution. Medusa Ransomware also has the ability to delete itself after execution through the command `cmd /c ping localhost -n 3 > nul & del`.

Medusa Ransomware has collected data from the SMBIOS firmware table using `GetSystemFirmwareTable`.

Medusa Group has searched for files within the victim environment for encryption and exfiltration. Medusa Group has also identified files associated with remote management services.

Medusa Ransomware has searched for files within the victim environment for encryption and exfiltration. Medusa Ransomware has also identified files associated with remote management services.

Medusa Ransomware has leveraged Windows Native API functions to execute payloads.

Medusa Group has leveraged Windows Native API functions to execute payloads.

Medusa Ransomware has discovered device uptime through `GetTickCount()`.

Medusa Ransomware has identified networked drives.

Medusa Ransomware has decoded XOR encrypted strings prior to execution in memory.

Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration. Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.

Medusa Ransomware has encrypted files using AES-256 encryption, which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”

Medusa Group has encrypted files using AES-256 encryption which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”

Medusa Ransomware has the capability to terminate services related to backups, security, databases, communication, filesharing and websites. Medusa Ransomware has also utilized the `taskkill /F /IM <process> /T` command to stop targeted processes and `net stop <process>` command to stop designated services.

Medusa Group has terminated services related to backups, security, databases, communication, filesharing and websites.

Medusa Ransomware has deleted recovery files such as shadow copies using `vssadmin.exe`.

Medusa Group has deleted recovery files such as shadow copies using `vssadmin.exe`.

Medusa Ransomware has created a new PowerShell process using the `CreateProcessA` API.

Medusa Ransomware has leveraged the `CreatePipe` API to enable inter-process communication.

Medusa Ransomware has utilized the `ShowWindow` function to hide current window.

Medusa Group has utilized the `ShowWindow` API function to hide the current window.

Medusa Group has stolen and encrypted victims' data in order to extort victims into paying a ransom.

Medusa Ransomware has avoided specified files, file extensions and folders to ensure successful execution of the payload and continued operations of the impacted device.

Medusa Ransomware has enumerated logical drives on infected hosts.

Medusa Ransomware has terminated antivirus services utilizing the gaze.exe executable. Medusa Ransomware has also terminated antivirus services utilizing PowerShell scripts.