Why the Medusa Advisory Is Worth Your Attention
In March 2025, CISA, the FBI, and MS-ISAC published a joint advisory (AA25-071A) on the Medusa ransomware-as-a-service operation. By that point Medusa affiliates had hit more than 300 organizations across healthcare, education, legal, insurance, technology, and manufacturing, and the count has kept climbing since. What makes the advisory useful is not the body count. It is that the attackers left a clear, well-documented trail, and almost every step they took maps to a control most organizations already own but have not switched on properly.
We read a lot of these advisories in our work, and the pattern rarely changes. The intrusion succeeds through an unpatched edge device or a phished credential, the attacker moves sideways using tools that are already on the network, security agents get killed with a signed but vulnerable driver, and the backups turn out to be reachable from the same domain the attacker just took over. Medusa is a textbook version of all four. This article walks through what the advisory actually describes, then turns each stage into something you can check on your own estate this week.
How Medusa Gets In
Two initial-access routes dominate the Medusa cases. The first is phishing to steal credentials, usually bought or brokered through initial access brokers. The second is direct exploitation of internet-facing software with known, patchable flaws. The advisory names two specifically: the ScreenConnect authentication bypass (CVE-2024-1709) and the Fortinet FortiClient EMS SQL injection (CVE-2023-48788). Both had patches available well before Medusa affiliates were seen using them at scale.
That gap between "patch exists" and "patch applied" is where most of the damage lives. Remote support tools and VPN appliances sit at the edge of the network, they are exposed to the whole internet, and they are exactly the systems that teams are nervous about rebooting during business hours. Attackers know this. They watch the disclosure feeds, weaponize within days, and count on the maintenance window that never quite happens.
There is a second, quieter lesson in the OPSWAT commentary that ran alongside the advisory in the industry press: a lot of the exposure sits in operational technology environments where the IT security team has little visibility. In plants, hospitals, and utilities, the OT side often runs older Windows hosts, flat networks, and remote-access software that nobody has inventoried in years. When an attacker lands there, the usual IT monitoring simply is not watching.
What Happens After the First Foothold
Once inside, Medusa affiliates rely heavily on living-off-the-land techniques, which means they use the tools that are supposed to be there. PowerShell and cmd.exe handle enumeration. Certutil pulls down additional payloads. Windows Management Instrumentation answers questions about the environment. Advanced IP Scanner and SoftPerfect Network Scanner map out what else is reachable. None of that trips a signature-based alert, because none of it is malware in the traditional sense.
For hands-on control they bring in legitimate remote monitoring and management software: AnyDesk, Atera, ConnectWise, N-able, PDQ Deploy, SimpleHelp, Splashtop, and others. This is the part defenders consistently underestimate. Your SOC will happily ignore an AnyDesk session because AnyDesk is a normal business tool. The attacker is counting on that assumption. Lateral movement then uses PsExec and RDP, credentials come from Mimikatz, and data is staged and pushed out with Rclone before anything is encrypted.
The encryptor itself, seen as gaze.exe in these cases, uses AES-256 and only runs after the operator has already stolen what they want. Tunneling utilities like Ligolo and Cloudflared keep a channel open. To clear the way, affiliates disable endpoint protection using the bring-your-own-vulnerable-driver method, loading a legitimately signed driver with a known flaw to kill EDR and antivirus from the kernel. They also wipe PowerShell history to slow down the investigation that follows.
Double Extortion, and Sometimes Worse
Medusa runs a double-extortion model. Files get encrypted, and a copy of the stolen data becomes leverage: pay, or the data gets published on a leak site. The advisory documents at least one case that went further into what it calls triple extortion, where a victim who paid was then contacted by a second actor claiming the original negotiator had stolen the ransom, and demanding payment again. Whether that was a genuine rift or a scripted shakedown does not really matter. The point is that paying buys you nothing you can rely on.
This is why the recovery conversation has to start long before an incident. If your only path back is the attacker's decryption key, you have already lost the negotiation. If you can restore from backups the attacker never touched, you have a bad week instead of an existential one.
Turning the Advisory Into Controls
Every technique above has a well-understood countermeasure. The table below maps the Medusa stages to the specific controls we deploy in client environments, framed against NIST CSF functions so the work slots into a program you can report on rather than a pile of disconnected fixes.
Medusa techniqueControl that blocks or contains itNIST CSF function
Exploiting ScreenConnect / Fortinet CVEs on edge devices
Risk-based patching with a defined SLA for internet-facing systems; external attack-surface monitoring
Identify / Protect
Phished or brokered credentials
Phishing-resistant MFA on every remote and admin service; conditional access
Protect
Living-off-the-land enumeration (PowerShell, WMI, certutil)
Constrained Language Mode, script-block logging, and behavioral EDR rather than signatures alone
Detect
Unauthorized RMM tools (AnyDesk, Atera, ConnectWise)
Application allow-listing; alert on any RMM binary not on the approved list
Detect
Lateral movement via PsExec and RDP
Network segmentation, tiered admin accounts, and no flat domain-admin reuse
Protect
EDR disabled through a vulnerable driver (BYOVD)
Microsoft vulnerable-driver blocklist, tamper protection, and out-of-band telemetry
Protect / Detect
Data exfiltration with Rclone before encryption
Egress filtering, DLP on large outbound transfers, and alerts on cloud-sync tooling
Detect
Encryption and extortion
Offline, immutable, segmented backups with tested restores
Recover
Notice how much of this is configuration and discipline, not new spend. Application allow-listing, script-block logging, the vulnerable-driver blocklist, and tiered administration are all achievable with the tooling most Windows-heavy organizations already license. The hard part is the operating rhythm: knowing what is on the edge, patching it on a clock, and testing that your backups actually restore.
Get the Backups Right First
If you only fix one thing after reading the Medusa advisory, make it your backups, because that is the control that decides whether an incident is recoverable. The old 3-2-1 rule is no longer enough against an attacker who spends days inside your network specifically hunting for backup servers to delete. The current standard we hold clients to is 3-2-1-1-0.
The two additions to the old rule are the ones that matter against ransomware. The extra "1" is a copy that is offline or immutable, meaning it cannot be altered or deleted even by an account with full domain privileges. Object-lock storage, air-gapped tape, and true immutable snapshots all qualify; a network share the backup service can overwrite does not. The "0" is verified recoverability: you have actually restored from that copy recently and confirmed zero errors. A backup you have never restored is a hypothesis, not a control.
Shrink the Remote-Access Attack Surface
Medusa's entire early game runs on remote access, both the appliances it exploits and the RMM tools it abuses. Two moves cut most of that off. First, inventory every remote-access and remote-support tool that can run in your environment, approve a short list, and treat the appearance of anything else as an incident. Second, force all legitimate remote administration through jump hosts and VPNs that sit behind phishing-resistant MFA, so a stolen password on its own gets an attacker nowhere.
A Practical Checklist to Run This Quarter
- Produce a live inventory of every internet-facing service, VPN concentrator, and remote-support tool, and confirm each is patched against known exploited vulnerabilities.
- Enforce phishing-resistant MFA on all remote access and every administrative account, with no exceptions for service or break-glass accounts that skip conditional access.
- Turn on PowerShell script-block logging and Constrained Language Mode, and route the logs to a SIEM where someone actually reviews them.
- Deploy application allow-listing and alert on any remote monitoring and management binary that is not on your approved list.
- Enable the Microsoft vulnerable-driver blocklist and EDR tamper protection to blunt bring-your-own-vulnerable-driver attacks.
- Move to a 3-2-1-1-0 backup posture with at least one immutable or air-gapped copy, and schedule a real restore test, not a checkbox.
- Segment the network so a compromised workstation cannot reach domain controllers, backup infrastructure, or OT systems directly.
- Write and rehearse an incident response plan that assumes data was already stolen before encryption, and includes legal, communications, and regulatory notification steps.
Work through that list against a recognized framework rather than ad hoc. We map client programs to NIST CSF and the CIS Critical Security Controls, and where the business carries regulated data we align the same work to ISO 27001 and PCI-DSS so a single hardening effort also carries audit weight. The controls that stop Medusa are, almost item for item, the controls those frameworks already ask for.
How Aydahwa Enterprise Can Help
Aydahwa Enterprise builds and hardens the kind of defenses the Medusa advisory calls for, drawing on more than 25 years of hands-on infrastructure and security work across banking, telecom, and critical national infrastructure. Our team holds credentials including ISO 27001, PCI-DSS, SOC 2, NIST CSF, CIS Benchmarks, and the Microsoft Cybersecurity Architect Expert certification, and we apply them to real environments rather than paper assessments.
If you want to know where you stand against an attacker like this, start with our free cybersecurity self-assessment and the cybersecurity readiness checklist. From there, our cybersecurity services cover attack-surface reduction, EDR and SIEM deployment, and ransomware-resilient backup design, while our cloud security and migration and managed IT support teams keep the controls running after the project ends. When you are ready to close the gaps the Medusa advisory exposes, get in touch and we will start with the systems most likely to be hit first.
