Japan

medusa

Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.

First seen 2023-01-11 · Last seen 2026-02-13 · 2 Japan claims

Tactics: Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Evasion, Credential Access, Discovery, Lateral Movement, Exfiltration, Command and Control, Impact

CVEs named by the source: CVE-2024-57727

Cached from ransomware.live. 2026-10-01 PT. Leak sites are not linked.