Medusa Ransomware Recovery: What's Recoverable

Medusa has been active since mid-2021 and grew significantly through 2023–2024 — enough that CISA issued a formal advisory on it in early 2025. It's compromised over 300 organizations, concentrated in healthcare, education, legal services and manufacturing, sectors where downtime carries consequences well beyond the immediate cost of the incident.

Entry is typically via brute-forced RDP credentials, known vulnerabilities (including CVE-2024-1709 in ScreenConnect and CVE-2023-48788 in Fortinet EMS), or phishing. Once inside, Medusa uses legitimate remote-admin tools — AnyDesk, PDQ Deploy, ScreenConnect — for lateral movement, which is part of why detection often lags: the tools themselves aren't inherently malicious. It encrypts with AES-256 and deletes shadow copies as a standard step.

Because Medusa's lateral movement relies on legitimate admin tools rather than obviously malicious software, the compromise often has a longer dwell time before discovery — meaning the scope of what's affected (which servers, which backups, which shares those admin tools reached) needs a proper assessment rather than an assumption based on the first encrypted system found.