Full Report
Symantec found that Medusa has listed almost 400 victims on its data leaks site since early 2023, demanding ransom payments as high as $15m
Analysis Summary
# Incident Report: Medusa Ransomware Campaign Surge (Early 2025)
## Executive Summary
Threat actors utilizing the Medusa Ransomware-as-a-Service (RaaS) have significantly increased their activity in early 2025, claiming over 40 victims in the first two months alone, nearly double the rate seen in the same period of 2024. The operators, tracked as Spearwing, primarily target organizations by exploiting unpatched public-facing vulnerabilities, notably in Microsoft Exchange Servers, followed by extensive data staging and double-extortion tactics. Response actions are crucial given the consistent TTPs and long dwell times observed before encryption.
## Incident Details
- Discovery Date: Ongoing analysis throughout Q1 2025
- Incident Date: Active throughout early 2025 (specific initial discovery dates vary by victim)
- Affected Organization: Multiple, including a US healthcare organization, SimonMed Imaging, Bell Ambulance (US), and HCRG Care Group (UK).
- Sector: Healthcare, Ambulance Services, Care Groups (Various)
- Geography: Global (Confirmed US and UK victims)
## Timeline of Events
### Initial Access
- **Date/Time:** Precedes encryption by several days to weeks (e.g., 4 days dwell time noted in one healthcare case).
- **Vector:** Exploiting unpatched vulnerabilities in public-facing applications, with a specific focus on **Microsoft Exchange Servers**.
- **Details:** Attackers gain an initial foothold, likely leveraging known security flaws.
### Lateral Movement
- **Details:** Attackers utilize legitimate tools and "living-off-the-land" techniques. Specifically observed tools used for movement include **PDQ Deploy** to drop additional tools, and potentially **Remote Management and Monitoring (RMM)** software (SimpleHelp, AnyDesk) for remote access and control.
### Data Exfiltration/Impact
- **Details:** Before encryption, threat actors steal data (double-extortion). Data is staged for exfiltration using tools like **Navicat** and **RoboCopy**. Once staging is complete, the ransomware is executed, appending the **.medusa** extension and deploying the **!READ\_ME\_MEDUSA!!!.txt** ransom note. Ransoms demanded ranged from \$100,000 to \$15 million.
### Detection & Response
- **How it was discovered:** Varies by victim; internal detection or discovery via Medusa's data leak site listings.
- **Response actions taken:** In the case of SimonMed Imaging, the firm claimed to have "interrupted" the attackers, preventing data encryption. Response generally involves identifying/removing the malware and rebuilding systems post-encryption.
## Attack Methodology
- **Initial Access:** Exploitation of unpatched vulnerabilities in public-facing applications (e.g., Microsoft Exchange Servers).
- **Persistence:** Not explicitly detailed, but implied through use of RMM tools.
- **Privilege Escalation:** Implied, as advanced lateral movement is described only after gaining initial access.
- **Defense Evasion:** Heavy reliance on **Bring Your Own Vulnerable Driver (BYOVD)** technique—deploying a signed vulnerable driver to disable security software. Use of legitimate/built-in tools (LOLBins).
- **Credential Access:** Not explicitly stated, but assumed for lateral movement.
- **Discovery:** Use of tools following initial access to map the network and identify valuable data.
- **Lateral Movement:** Use of **PDQ Deploy** and RMM tools.
- **Collection:** Data searched for and copied using tools like **Navicat** and **RoboCopy**.
- **Exfiltration:** Data theft prior to encryption (double extortion).
- **Impact:** Data encryption (.medusa extension) and data publication threat. The ransomware malware can self-delete post-execution.
## Impact Assessment
- **Financial:** Ransoms demanded up to \$15 million. Costs associated with recovery and associated business disruption.
- **Data Breach:** Significant data exfiltration documented; e.g., SimonMed Imaging (2013 GB claimed), Bell Ambulance (212 GB claimed), HCRG Care Group (nearly 2.3 TB claimed).
- **Operational:** Loss of operational capability due to encryption. Bell Ambulance notified employees of an attack; SimonMed Imaging successfully interrupted encryption.
- **Reputational:** Public listing of victims on Medusa's data leak site.
## Indicators of Compromise
- **Network indicators (Defanged):** Not specified in the source text, but would involve connections to known Medusa C2 infrastructure.
- **File indicators:** Ransom note named `!READ_ME_MEDUSA!!!.txt`; Encrypted files appended with **.medusa** extension.
- **Behavioral indicators:** Use of RMM tools (SimpleHelp, AnyDesk, PDQ Deploy) for administrative tasks; deployment of vulnerable signed drivers (BYOVD).
## Response Actions
- **Containment:** Interrupting attacker activity before full encryption (as noted in the SimonMed case). Removing RMM tools deployed by the adversary.
- **Eradication:** Deleting the self-removing ransomware payload.
- **Recovery:** Restoring encrypted systems from backups; scrubbing network components of persistence mechanisms.
## Lessons Learned
- **Key takeaways:** Attackers are capitalizing on the decrease of legacy RaaS groups, leading to the rise of groups like Medusa/Spearwing. Dwell time remains a significant issue, allowing deep reconnaissance and effective data staging.
- **What could have been done better:** Timely patching of public-facing vulnerabilities, especially Microsoft Exchange Servers, is critical to prevent initial access.
## Recommendations
- **Prevention measures for similar incidents:**
1. Immediately patch all internet-facing applications, prioritizing Microsoft Exchange Servers.
2. Implement robust monitoring for the deployment of unsigned/vulnerable drivers (BYOVD detection).
3. Restrict or centrally manage the use of RMM tools to trusted IT personnel only, and monitor their use for unauthorized lateral movement.
4. Enhance detection of living-off-the-land binaries being used for unusual enumeration or copying (e.g., RoboCopy outside standard backup routines).
5. Segment critical networks to limit the extent of lateral movement following initial compromise.