Blog
/
Network
/
June 10, 2024

Darktrace Investigation Into Medusa Ransomware

See how Darktrace empowers organizations to fight back against Medusa ransomware, enhancing their cybersecurity posture with advanced technology.
Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Maria Geronikolou
Cyber Analyst
Default blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog imageDefault blog image
10
Jun 2024

What is Living off the Land attack?

In the face of increasingly vigilant security teams and adept defense tools, attackers are continually looking for new ways to circumvent network security and gain access to their target environments. One common tactic is the leveraging of readily available utilities and services within a target organization’s environment in order to move through the kill chain; a popular method known as living off the land (LotL). Rather than having to leverage known malicious tools or write their own malware, attackers are able to easily exploit the existing infrastructure of their targets.

The Medusa ransomware group in particular are known to extensively employ LotL tactics, techniques and procedures (TTPs) in their attacks, as one Darktrace customer in the US discovered in early 2024.

What is Medusa Ransomware?

Medusa ransomware (not to be confused with MedusaLocker) was first observed in the wild towards the end of 2022 and has been a popular ransomware strain amongst threat actors since 2023 [1]. Medusa functions as a Ransomware-as-a-Service (RaaS) platform, providing would-be attackers, also know as affiliates, with malicious software and infrastructure required to carry out disruptive ransomware attacks. The ransomware is known to target organizations across many different industries and countries around the world, including healthcare, education, manufacturing and retail, with a particular focus on the US [2].

How does Medusa Ransomware work?

Medusa affiliates are known to employ a number of TTPs to propagate their malware, most predominantly gaining initial access by exploiting vulnerable internet-facing assets and targeting valid local and domain accounts that are used for system administration.

The ransomware is typically delivered via phishing and spear phishing campaigns containing malicious attachments [3] [4], but it has also been observed using initial access brokers to access target networks [5]. In terms of the LotL strategies employed in Medusa compromises, affiliates are often observed leveraging legitimate services like the ConnectWise remote monitoring and management (RMM) software and PDQ Deploy, in order to evade the detection of security teams who may be unable to distinguish the activity from normal or expected network traffic [2].

According to researchers, Medusa has a public Telegram channel that is used by threat actors to post any data that may have been stolen, likely in an attempt to extort organizations and demand payment [2].  

Darktrace’s Coverage of Medusa Ransomware

Established Foothold and C2 activity

In March 2024, Darktrace / NETWORK identified over 80 devices, including an internet facing domain controller, on a customer network performing an unusual number of activities that were indicative of an emerging ransomware attack. The suspicious behavior started when devices were observed making HTTP connections to the two unusual endpoints, one of which is “go-sw6-02.adventos[.]de”, with the PowerShell and JWrapperDownloader user agents.

Darktrace’s Cyber AI Analyst™ launched an autonomous investigation into the connections and was able to connect the seemingly separate events into one wider incident spanning multiple different devices. This allowed the customer to visualize the activity in chronological order and gain a better understanding of the scope of the attack.

At this point, given the nature and rarity of the observed activity, Darktrace /NETWORK's autonomous response would have been expected to take autonomous action against affected devices, blocking them from making external connections to suspicious locations. However, autonomous response was not configured to take autonomous action at the time of the attack, meaning any mitigative actions had to be manually approved by the customer’s security team.

Internal Reconnaissance

Following these extensive HTTP connections, between March 1 and 7, Darktrace detected two devices making internal connection attempts to other devices, suggesting network scanning activity. Furthermore, Darktrace identified one of the devices making a connection with the URI “/nice ports, /Trinity.txt.bak”, indicating the use of the Nmap vulnerability scanning tool. While Nmap is primarily used legitimately by security teams to perform security audits and discover vulnerabilities that require addressing, it can also be leveraged by attackers who seek to exploit this information.

Darktrace / NETWORK model alert showing the URI “/nice ports, /Trinity.txt.bak”, indicating the use of Nmap.
Figure 1: Darktrace /NETWORK model alert showing the URI “/nice ports, /Trinity.txt.bak”, indicating the use of Nmap.

Darktrace observed actors using multiple credentials, including “svc-ndscans”, which was also seen alongside DCE-RPC activity that took place on March 1. Affected devices were also observed making ExecQuery and ExecMethod requests for IWbemServices. ExecQuery is commonly utilized to execute WMI Query Language (WQL) queries that allow the retrieval of information from WI, including system information or hardware details, while ExecMethod can be used by attackers to gather detailed information about a targeted system and its running processes, as well as a tool for lateral movement.

Lateral Movement

A few hours after the first observed scanning activity on March 1, Darktrace identified a chain of administrative connections between multiple devices, including the aforementioned internet-facing server.

Cyber AI Analyst was able to connect these administrative connections and separate them into three distinct ‘hops’, i.e. the number of administrative connections made from device A to device B, including any devices leveraged in between. The AI Analyst investigation was also able to link the previously detailed scanning activity to these administrative connections, identifying that the same device was involved in both cases.

Cyber AI Analyst investigation into the chain of lateral movement activity.
Figure 2: Cyber AI Analyst investigation into the chain of lateral movement activity.

On March 7, the internet exposed server was observed transferring suspicious files over SMB to multiple internal devices. This activity was identified as unusual by Darktrace compared to the device's normal SMB activity, with an unusual number of executable (.exe) and srvsvc files transferred targeting the ADMIN$ and IPC$ shares.

Cyber AI Analyst investigation into the suspicious SMB write activity.
Figure 3: Cyber AI Analyst investigation into the suspicious SMB write activity.
Graph highlighting the number of successful SMB writes and the associated model alerts.
Figure 4: Graph highlighting the number of successful SMB writes and the associated model alerts.

The threat actor was also seen writing SQLite3*.dll files over SMB using a another credential this time. These files likely contained the malicious payload that resulted in the customer’s files being encrypted with the extension “.s3db”.

Darktrace’s visibility over an affected device performing successful SMB writes.
Figure 5: Darktrace’s visibility over an affected device performing successful SMB writes.

Encryption of Files

Finally, Darktrace observed the malicious actor beginning to encrypt and delete files on the customer’s environment. More specifically, the actor was observed using credentials previously seen on the network to encrypt files with the aforementioned “.s3db” extension.

Darktrace’s visibility over the encrypted files.
Figure 6: Darktrace’s visibility over the encrypted files.


After that, Darktrace observed the attacker encrypting  files and appending them with the extension “.MEDUSA” while also dropping a ransom note with the file name “!!!Read_me_Medusa!!!.txt”

Darktrace’s detection of threat actors deleting files with the extension “.MEDUSA”.
Figure 7: Darktrace’s detection of threat actors deleting files with the extension “.MEDUSA”.
Darktrace’s detection of the Medusa ransom note.
Figure 8: Darktrace’s detection of the Medusa ransom note.

At the same time as these events, Darktrace observed the attacker utilizing a number of LotL techniques including SSL connections to “services.pdq[.]tools”, “teamviewer[.]com” and “anydesk[.]com”. While the use of these legitimate services may have bypassed traditional security tools, Darktrace’s anomaly-based approach enabled it to detect the activity and distinguish it from ‘normal’ network activity. It is highly likely that these SSL connections represented the attacker attempting to exfiltrate sensitive data from the customer’s network, with a view to using it to extort the customer.

Cyber AI Analyst’s detection of “services.pdq[.]tools” usage.
Figure 9: Cyber AI Analyst’s detection of “services.pdq[.]tools” usage.

If this customer had been subscribed to Darktrace's Proactive Threat Notification (PTN) service at the time of the attack, they would have been promptly notified of these suspicious activities by the Darktrace Security Operation Center (SOC). In this way they could have been aware of the suspicious activities taking place in their infrastructure before the escalation of the compromise. Despite this, they were able to receive assistance through the Ask the Expert service (ATE) whereby Darktrace’s expert analyst team was on hand to assist the customer by triaging and investigating the incident further, ensuring the customer was well equipped to remediate.  

As Darktrace /NETWORK's autonomous response was not enabled in autonomous response mode, this ransomware attack was able to progress to the point of encryption and data exfiltration. Had autonomous response been properly configured to take autonomous action, Darktrace would have blocked all connections by affected devices to both internal and external endpoints, as well as enforcing a previously established “pattern of life” on the device to stop it from deviating from its expected behavior.

Conclusion

The threat actors in this Medusa ransomware attack attempted to utilize LotL techniques in order to bypass human security teams and traditional security tools. By exploiting trusted systems and tools, like Nmap and PDQ Deploy, attackers are able to carry out malicious activity under the guise of legitimate network traffic.

Darktrace’s Self-Learning AI, however, allows it to recognize the subtle deviations in a device’s behavior that tend to be indicative of compromise, regardless of whether it appears legitimate or benign on the surface.

Further to the detection of the individual events that made up this ransomware attack, Darktrace’s Cyber AI Analyst was able to correlate the activity and collate it under one wider incident. This allowed the customer to track the compromise and its attack phases from start to finish, ensuring they could obtain a holistic view of their digital environment and remediate effectively.

[related-resource]

Appendices

Credit to Maria Geronikolou, Cyber Analyst, Ryan Traill, Threat Content Lead

Darktrace DETECT Model Detections

Anomalous Connection / SMB Enumeration

Device / Anomalous SMB Followed By Multiple Model Alerts

Device / Suspicious SMB Scanning Activity

Device / Attack and Recon Tools

Device / Suspicious File Writes to Multiple Hidden SMB Share

Compromise / Ransomware / Ransom or Offensive Words Written to SMB

Device / Internet Facing Device with High Priority Alert

Device / Network Scan

Anomalous Connection / Powershell to Rare External

Device / New PowerShell User Agent

Possible HTTP Command and Control

Extensive Suspicious DCE-RPC Activity

Possible SSL Command and Control to Multiple Endpoints

Suspicious Remote WMI Activity

Scanning of Multiple Devices

Possible Ransom Note Accessed over SMB

List of Indicators of Compromise (IoCs)

IoC – Type – Description + Confidence

207.188.6[.]17      -     IP address   -      C2 Endpoint

172.64.154[.]227 - IP address -        C2 Endpoint

go-sw6-02.adventos[.]de.  Hostname  - C2 Endpoint

.MEDUSA             -        File extension     - Extension to encrypted files

.s3db               -             File extension    -  Created file extension

SQLite3-64.dll    -        File           -               Used tool

!!!Read_me_Medusa!!!.txt - File -   Ransom note

Svc-ndscans         -         Credential     -     Possible compromised credential

Svc-NinjaRMM      -       Credential      -     Possible compromised credential

MITRE ATT&CK Mapping

Discovery  - File and Directory Discovery - T1083

Reconnaissance    -  Scanning IP            -          T1595.001

Reconnaissance -  Vulnerability Scanning -  T1595.002

Lateral Movement -Exploitation of Remote Service -  T1210

Lateral Movement - Exploitation of Remote Service -   T1210

Lateral Movement  -  SMB/Windows Admin Shares     -    T1021.002

Lateral Movement   -  Taint Shared Content          -            T1080

Execution   - PowerShell     - T1059.001

Execution  -   Service Execution   -    T1059.002

Impact   -    Data Encrypted for Impact  -  T1486

References

[1] https://unit42.paloaltonetworks.com

[2] https://thehackernews.com

[3] https://trustwave.com

[4] https://www.sangfor.com

[5] https://thehackernews.com

[6]https://any.run

Get the latest insights on emerging cyber threats

This report explores the latest trends shaping the cybersecurity landscape and what defenders need to know in 2025.

Inside the SOC
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Maria Geronikolou
Cyber Analyst

More in this series

No items found.

Blog

/

/

July 23, 2025

Closing the Cloud Forensics and Incident Response Skills Gap

DFIR skills gap, man working on computer, SOC analyst, incident response, cloud incident responseDefault blog imageDefault blog image

Every alert that goes uninvestigated is a calculated risk — and teams are running out of room for error

Security operations today are stretched thin. SOCs face an overwhelming volume of alerts, and the shift to cloud has only made triage more complex.

Our research suggests that 23% of cloud alerts are never investigated, leaving risk on the table.

The rapid migration to cloud resources has security teams playing catch up. While they attempt to apply traditional on-prem tools to the cloud, it’s becoming increasingly clear that they are not fit for purpose. Especially in the context of forensics and incident response, the cloud presents unique complexities that demand cloud-specific solutions.

Organizations are increasingly adopting services from multiple cloud platforms (in fact, recent studies suggest 89% of organizations now operate multi-cloud environments), and container-based and serverless setups have become the norm. Security analysts already have enough on their plates; it’s unrealistic to expect them to be cloud experts too.

Why Digital Forensics and Incident Response (DFIR) roles are so hard to fill

Compounding these issues of alert fatigue and cloud complexity, there is a lack of DFIR talent. The cybersecurity skills gap is a well-known problem.

According to the 2024 ISC2 Cybersecurity Workforce Study, there is a global shortage of 4.8 million cybersecurity workers, up 19% from the previous year.

Why is this such an issue?

  • Highly specialized skill set: DFIR professionals need to have a deep understanding of various operating systems, network protocols, and security architectures, even more so when working in the cloud. They also need to be proficient in using a wide range of forensic tools and techniques. This level of expertise takes a lot of time and effort to develop.
  • Rapid technological changes: The cloud landscape is constantly changing and evolving with new services, monitoring tools, security mechanisms, and threats emerging regularly. Keeping up with these changes and staying current requires continuous learning and adaptation.
  • Lack of formal education and training: There are limited educational programs specifically dedicated for DFIR. Further, an industry for cloud DFIR has yet to be defined. While some universities and institutions offer courses or certifications in digital forensics, they may not cover the full spread of knowledge required in real-world incident response scenarios, especially for cloud-based environments.
  • High-stress nature of the job: DFIR professionals often work under tight deadlines in high-pressure situations, especially when handling security incidents. This can lead to burnout and high turnover rates in the profession.

Bridging the skills gap with usable cloud digital forensics and incident response tools  

To help organizations close the DFIR skills gap, it's critical that we modernize our approaches and implement a new way of doing things in DFIR that's fit for the cloud era. Modern cloud forensics and incident response platforms must prioritize usability in order to up-level security teams. A platform that is easy to use has the power to:

  • Enable more advanced analysts to be more efficient and have the ability to take on more cases
  • Uplevel more novel analysts to perform more advanced tasks than ever before
  • Eliminate cloud complexity– such as the complexities introduced by multi-cloud environments and container-based and serverless setups

What to look for in cloud forensics and incident response solutions

The following features greatly improve the impact of cloud forensics and incident response:

Data enrichment: Automated correlation of collected data with threat intelligence feeds, both external and proprietary, delivers immediate insight into suspicious or malicious activities. Data enrichment expedites investigations, enabling analysts to seamlessly pivot from key events and delve deeper into the raw data.

Single timeline view: A unified perspective across various cloud platforms and data sources is crucial. A single timeline view empowers security teams to seamlessly navigate evidence based on timestamps, events, users, and more, enhancing investigative efficiency. Pulling together a timeline has historically been a very time consuming task when using traditional approaches.

Saved search: Preserving queries during investigations allows analysts to re-execute complex searches or share them with colleagues, increasing efficiency and collaboration.

Faceted search: Facet search options provide analysts with quick insights into core data attributes, facilitating efficient dataset refinement.

Cross-cloud investigations: Analyzing evidence acquired from multiple cloud providers in a single platform is crucial for security teams. A unified view and timeline across cross cloud is critical in streamlining investigations.

How Darktrace can help

Darktrace’s cloud offerings have been bolstered with the acquisition of Cado Security Ltd., which enables security teams to gain immediate access to forensic-level data in multi-cloud, container, serverless, SaaS, and on-premises environments.

Not only does Darktrace offer centralized automation solutions for cloud forensics and investigation, but it also delivers a proactive approach Cloud Detection and Response (CDR). Darktrace / CLOUD is built with advanced AI to make cloud security accessible to all security teams and SOCs. By using multiple machine learning techniques, Darktrace brings unprecedented visibility, threat detection, investigation, and incident response to hybrid and multi-cloud environments.

[related-resource]

Continue reading
About the author

Blog

/

Email

/

July 23, 2025

Global Telecom Provider: Powering and Protecting the World's Data Giants

Default blog imageDefault blog image

This global leader plays a critical role in keeping the world connected. The company works with some of the largest and most influential public and private organizations in the world to enable ultra-fast data transmission.

Safeguarding the systems that keep the world connected

Standing at the forefront of global connectivity, this industry leader designs and manages large-scale communications systems that power the world’s most data-intensive enterprises – including social media giants, hyperscale cloud providers, and major data center operators. Given the scale, confidentiality, and sensitivity of the systems and data it helps transport, the company faces complex cybersecurity challenges.

Protecting sensitive customer data

Most of the organization’s projects are custom-designed and highly proprietary, making data privacy and Intellectual Property (IP) protection critical to maintaining trust and confidentiality with customers. In an industry where every competitor knows the landscape intimately, any loss of data could cause significant damage.

International security implications

The company faces a broad range of advanced cyber threats – from corporate espionage and supply chain risks to cyber-physical attacks on critical infrastructure. Its international footprint adds complexity, including cross-border regulatory compliance. A successful attack could disrupt business, compromise IP, or trigger wider consequences like disruptions to international data transfers and other critical services.

The global leader works closely with communities to anticipate threats that could impact the global communications network at large.

In this environment, cybersecurity is a foundation for international trust,” said the organization’s CISO.

Building a resilient cybersecurity strategy from the ground up

The CISO had the rare opportunity to build the IT and cybersecurity infrastructure from scratch. "Initially, we bought what everyone else buys,” referencing the traditional mix of firewalls, routers, and antivirus tools. “But I knew we needed to do more.”

Self-Learning AI – “the missing piece”

With solid perimeter defenses in place, the security team sought deeper protection inside the network. Darktrace’s Self-Learning AI stood out. “Unlike other solutions, Darktrace’s AI looks beyond known threat signatures, learning what’s normal for our environment and flagging what’s not. That was the missing piece – something that could help us even when everything else failed.”

A solution and partnership that delivered

The CISO said he appreciated the ability to observe Darktrace in action before full deployment, noting that the Darktrace team was there every step of the way, providing guidance and expertise to ensure he got the most out of his investment.

Partnership was especially valuable given the company’s explosive 400% growth over the last six years. As resources were stretched and priorities shifted, “Darktrace remained patient and responsive. We’re slow and methodical, but the Darktrace support team was phenomenal, never losing momentum and earning our trust.”

A unified cybersecurity ecosystem

Today, the global leader is using the Darktrace ActiveAI Security Platform™ as a core part of its layered defense strategy, including:

The CISO appreciates how, as a unified cybersecurity platform, Darktrace has an intuitive user interface, which makes it easier for his team to investigate alerts visually, even without deep technical expertise.

Advancing defenses while impacting the bottom line

A 24/7 “safety net”

The fact that this company has never been hacked is the clearest proof it made the right decision with Darktrace, said the CISO. Initially rolled out in Human Confirmation Mode, meaning it would not take autonomous action without explicit approval from the security team, Darktrace immediately uncovered threats and anomalies that other tools had missed.

Darktrace acts as a must-have safety net—ready to step in when other tools fall short,” said the CISO.

From monitoring internal behavior and identifying unusual attack patterns, to autonomously neutralizing threats after hours, the platform provides peace of mind in a high-stakes industry. “Darktrace is my dark horse – the thing I have in my back pocket if everything else fails. It’s here to save the day, save my company, and maybe even save my career.”

Autonomous capabilities free up time for skilled analysts

Darktrace’s AI-powered detection and response capabilities are deeply embedded in the team’s day-to-day operations, autonomously investigating and responding to the majority of potential threats. Cyber AI Analyst conducted a total of 2,776 total investigations within three months, averaging just 12 minutes to autonomously investigate an incident. Of those 2,776 investigations, Darktrace resolved 2,671 (96%) autonomously and escalated only 105 (4%) to analysts. Darktrace has dramatically reduced alert fatigue and freed up analysts to focus on what really matters, saving the security team 486 analyst hours on investigations within a 20-day period.

From noise to actionable insight

Darktrace delivers meaningful data and meaningful alerts. “If Darktrace escalates an incident, we drop everything and work on that. We trust in Darktrace.” When analysts do need to investigate an incident, Darktrace’s forensic logs and guided remediation suggestions have slashed the time analysts spend on investigations by four to five times.

Stronger security. Lower cost.

The CISO says, “Darktrace is a money-saver for our organization, making continued investments an easy sell to the CEO and the board.”  When he found himself down a resource after a member of the security team left the organization, the CISO turned to Darktrace Managed Threat Detection and Response services for 24/7 expert support. “It was a no brainer. We got better coverage, higher skill levels, and around-the-clock support – all for less than what we would pay to employ a single analyst.”

Scaling securely into the future

Securing networks in motion  

The organization is preparing to scale both its operations and security posture across existing distributed, mobile and deployable communications networks that historically have been disconnected. Some of these networks are in constant motion and operating in some of the world’s most volatile regions. “Darktrace will act as an autonomous defender, monitoring for anomalous behavior and intervening, when necessary, especially during those dangerous times when an asset ‘goes dark’ and becomes disconnected from the broader network,” said the CISO.

Applying AI strategically

As the organization continues to evaluate where and how to apply AI, its emphasis will be on technologies that can act independently to contain threats – especially in environments where human response may be delayed. “It’s about using the right kind of AI for the right challenge. That’s why we’re investing in Darktrace, with tools that can adapt and learn even in isolation and provide real-time protection wherever we operate.”

Continue reading
About the author
The Darktrace Community
Your data. Our AI.
Elevate your network security with Darktrace AI