Madusa Ransomware 2025: RMM Abuse in Ransomware Campaigns

According to the US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI), Medusa ransomware emerged in 2025 as one of the top 10 most active ransomware threat actors, prompting a joint advisory and, by January 2026, more than 500 organisations had fallen victim.

Darktrace’s Threat Research team observed that Medusa’s RaaS operations increasingly abused legitimate RMM tools such as SimpleHelp for initial access, lateral movement, data exfiltration and even ransomware deployment, with other tools including Atera and various remote access utilities also being leveraged.

Detections highlighted exploitation of GoAnywhere MFT (CVE-2025-10035) and SimpleHelp vulnerabilities (CVE-2024-57726, CVE-2024-57727, CVE-2024-57728), while data exfiltration was observed to destinations such as erp.ranasons[.]com and pruebas.pintacuario[.]mx over ports 443, 445 and 80. In one late-2025 European case, Darktrace’s Autonomous Response helped contain the attack, even when access was difficult to observe due to partial network coverage and manual confirmation requirements.

The findings underscore how attackers mimic legitimate administrative activity to evade detection and emphasise the need for anomaly-based detection and prompt patching of exposed RMM servers.