The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Medusa is a ransomware-as-a-service operation that uses affiliates, stolen credentials, and unpatched software to gain access, then can encrypt files and threaten to publish stolen data. The practical priorities for defenders are to reduce exposed access paths, limit lateral movement, protect and test backups, and prepare a reporting and recovery process.
What is Medusa ransomware?
The FBI, CISA, and Multi-State Information Sharing and Analysis Center (MS-ISAC) describe Medusa as a ransomware-as-a-service (RaaS) variant first identified in June 2021. Their joint advisory, AA25-071A, was published March 12, 2025. It says Medusa developers and affiliates had affected more than 300 victims across critical infrastructure sectors as of February 2025, including medical, education, legal, insurance, technology, and manufacturing organizations.
Medusa began as a closed operation and later adopted an affiliate model. Affiliates can carry out parts of an intrusion, while the advisory says important activity such as ransom negotiation remained centrally controlled by the developers. This Medusa is not MedusaLocker or the Medusa mobile malware variant.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsHow the extortion works
The advisory describes double extortion: attackers encrypt data and threaten to publish data they have stolen if the victim does not pay. It also records one investigated case in which, after a ransom payment, another actor claimed the negotiator had stolen the money and demanded an additional half-payment for a “true decryptor.” The advisory says this single case could indicate triple extortion; it does not establish that as Medusa’s standard approach.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How Medusa has gained access and operated
AA25-071A describes access brokers recruited through cybercriminal forums and marketplaces, phishing used to steal credentials, and exploitation of unpatched software. Examples in the advisory include ScreenConnect CVE-2024-1709 and Fortinet EMS CVE-2023-48788. Those examples are not a complete list of possible entry points, nor do they establish that an organization exposed to either vulnerability has been targeted.
After gaining a foothold, actors may look for systems and paths that help them move through a network, access data, and interfere with recovery. The advisory reports use of legitimate utilities such as Advanced IP Scanner and SoftPerfect Network Scanner for enumeration. It also describes PowerShell, Windows Command Prompt, Windows Management Instrumentation, and certutil in observed discovery, transfer, or evasion activity. These tools have legitimate administrative uses; seeing one in isolation does not identify a Medusa incident.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Encryption and recovery interference
The advisory maps observed techniques to MITRE ATT&CK Enterprise framework version 16, including data encryption for impact and interference with recovery. In its described activity, a file named gaze.exe terminated services and deleted shadow copies before encrypting files with AES-256 and dropping a ransom note. Treat these details as behaviors reported in the March 2025 advisory, not as a definitive signature for every Medusa intrusion.
The FBI ransomware page, accessed October 7, 2026, lists a newer Medusa alert dated August 18, 2026. The linked alert was not available in the material reviewed for this article, so it is not possible here to establish what it changed or whether earlier technical indicators remain valid. Do not use filenames or indicators from the 2025 advisory as a current blocklist without first checking the latest official alert.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How to reduce the risk and limit damage
The joint advisory’s immediate recommendations center on reducing exploitable access, limiting movement between systems, and protecting recovery. Apply them as an organizational program rather than treating a single tool or backup device as a complete defense.
Close likely access paths
- Use risk-informed patching to mitigate known vulnerabilities, prioritizing systems that are exposed or critical to the organization.
- Require multifactor authentication, especially for webmail, VPN, and accounts that administer critical systems.
- Use access controls appropriate to each account and system, and disable unused ports.
- Filter network traffic so unknown or untrusted origins cannot reach internal remote services.
Constrain spread and detect suspicious activity
- Segment networks so a compromise in one area does not automatically provide access to other systems.
- Monitor for unauthorized scanning and access attempts. Investigate context and related activity rather than treating a common administrative utility alone as proof of compromise.
- Test and validate security controls against the techniques described in the advisory, and update those tests as official guidance changes.
Make recovery resilient
Maintain multiple copies of sensitive data and servers in physically separate, segmented, secure locations. The advisory calls for offline backups, regular maintenance of backups and restoration processes, and backups that are encrypted and immutable and cover the organization’s data infrastructure.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
An external hard drive can be one physically separate storage device for an offline copy, but it is only one component. By itself, a drive does not ensure that backups are segmented, immutable, encrypted, comprehensive, or restorable. Define which systems and data must be recovered, protect backup access, and practice restoration so the organization can identify gaps before an incident.
Recommended Free Tools
What to do if you suspect a Medusa incident
Use your organization’s incident-response and continuity plans; the advisory’s recommendations are not a substitute for incident-specific forensic or legal advice. Preserve relevant information while following those plans, and coordinate with qualified responders and appropriate authorities.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
- Activate incident response. Notify the internal security and leadership contacts designated in your plan, and coordinate containment and recovery actions through the response team.
- Preserve useful details. The joint advisory identifies incident timing, scope and impact, suspected initial access, host and network indicators, communications, and ransom-note material as useful information to share. Preserve relevant records and evidence in line with your response procedures.
- Report the incident. The FBI advises victims to contact a local FBI field office or report through the Internet Crime Complaint Center (IC3). The joint advisory also identifies FBI and CISA reporting routes.
- Make payment decisions with qualified advice. The FBI states, “The FBI does not support paying a ransom in response to a ransomware attack.” Payment does not guarantee recovery of files and may encourage further targeting or fund criminal activity. Reporting does not guarantee decryption or recovery.
Which official guidance to use
For the behaviors and mitigation recommendations described here, consult the FBI, CISA, and MS-ISAC joint advisory AA25-071A, “#StopRansomware: Medusa Ransomware,” published March 12, 2025. For victim reporting and payment guidance, consult the FBI’s “Ransomware” page. Check the FBI’s current Medusa listing and the latest linked official alert before relying on technical indicators, because the FBI page lists a later Medusa alert dated August 18, 2026.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
