A Deep Dive into Medusa Ransomware

Prepared by: Vlad Pasca, Senior Malware &

Threat Analyst

SecurityScorecard.com

info@securityscorecard.com

Tower 49

12 E 49th Street

Suite 15-001

New York, NY 10017

1.800.682.1707

Table of contents

Table of contents 1

Executive summary 2

Analysis and findings 2

Indicators of Compromise 18

Appendix 19

securityscorecard.com | 1

Executive summary

Medusa ransomware appeared in June 2021, and it became more active this year by launching the “Medusa Blog” containing data leaked from victims that didn’t pay the ransom. The malware stops a list of services and processes decrypted at runtime and deletes the Volume Shadow Copies.

The files are encrypted using the AES256 algorithm, with the key being encrypted using an…