Medusa's primary goals are financial gain through extortion and disruption. They accomplish this through a double-extortion model:

1. Data Exfiltration: They steal sensitive data from victims' networks before encryption.

2. Data Encryption: They encrypt critical files, rendering systems and services unusable.

Extortion: They demand a ransom payment for the decryption key and to prevent the public release of the stolen data on their data leak site (DLS). They even offer to extend the data leak countdown for a daily fee of $10,000. Yikes.

So, how do they pull this off? Medusa actors are big fans of using what's already there, a technique known as "living-off-the-land" (LotL). This helps them blend in and avoid detection.

• Initial Access: They often get their foot in the door by exploiting unpatched vulnerabilities in public-facing applications like Microsoft Exchange, ScreenConnect (CVE-2024-1709), and Fortinet (CVE-2023-48788). Phishing campaigns are also a go-to method for snatching credentials.

• Discovery & Lateral Movement: Once inside, they use legitimate tools like Advanced IP Scanner and SoftPerfect Network Scanner to map out the network. They move across the network using Remote Desktop Protocol (RDP) and legitimate remote access tools like AnyDesk, ConnectWise, and SimpleHelp.

Defense Evasion: Medusa actors use a "Bring Your Own Vulnerable Driver" (BYOVD) technique to disable security software. They deploy a signed, vulnerable driver to kill EDR and antivirus processes. They also use PowerShell with obfuscated and base64-encoded commands to fly under the radar.

Medusa's playbook is pretty consistent, which might mean they either have a small, tight-knit group of affiliates or provide a very specific set of instructions.

• Credential Dumping: They use tools like Mimikatz to pull credentials from memory (LSASS dumping), giving them the keys to move around the network freely.

• Data Exfiltration: The tool of choice for smuggling data out is often Rclone, a command-line program for managing files on cloud storage.

Payload Deployment: They use legitimate software deployment tools like PsExec and PDQ Deploy to push their ransomware payload, gaze.exe, across the network. Before encrypting, this payload terminates security services, backup processes, and deletes volume shadow copies to prevent easy recovery.