Medusa Ransomware Exploits Vulnerabilities, Impacting Critical Sectors
The Medusa ransomware group, operating as a ransomware-as-a-service (RaaS), has been rapidly exploiting vulnerabilities across various sectors, according to Microsoft. Active since June 2021, Medusa has targeted over 300 organizations, particularly in critical infrastructure, by February 2025. The group employs double extortion tactics, encrypting data and threatening public exposure. They gain initial access through phishing and unpatched vulnerabilities, moving quickly to post-compromise operations. Medusa's operators, identified as Storm-1175, have been noted for their swift exploitation of newly disclosed vulnerabilities and zero-day bugs, impacting sectors such as healthcare, education, and finance in the U.S., U.K., and Australia. The group has exploited at least 16 vulnerabilities in systems like Microsoft Exchange and SAP NetWeaver, often deploying ransomware within a day of gaining access. 
