January 8, 2026

Under Medusa’s Gaze: How Darktrace Uncovers RMM Abuse in Ransomware Campaigns

Medusa ransomware increasingly exploits remote monitoring and management (RMM) tools for persistence, lateral movement, and data exfiltration. This blog explores Medusa’s tactics, real-world detections, and how anomaly-based solutions with Autonomous Response can stop attacks.

Written by

Signe Zaharka

Principal Cyber Analyst

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Signe Zaharka

Principal Cyber Analyst

Jan 2026

What is Medusa Ransomware in 2025?

In 2025, the Medusa Ransomware-as-a-Service (RaaS) emerged as one of the top 10 most active ransomware threat actors [1]. Its growing impact prompted a joint advisory from the US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) [3]. As of January 2026, more than 500 organizations have fallen victim to Medusa ransomware [2].

Darktrace previously investigated Medusa in a 2024 blog, but the group’s rapid expansion and new intelligence released in late 2025 has lead Darktrace’s Threat Research team to investigate further. Recent findings include Microsoft’s research on Medusa actors exploiting a vulnerability in Fortra’s GoAnywhere MFT License Servlet (CVE-2025-10035)[4] and Zencec’s report on Medusa’s abuse of flaws in SimpleHelp’s remote support software (CVE-2024-57726, CVE-2024-57727, CVE-2024-57728) [5].

Reports vary on when Medusa first appeared in the wild. Some sources mention June 2021 as the earliest sightings, while others point to late 2022, when its developers transitioned to the RaaS model, as the true beginning of its operation [3][11].

Medusa Ransomware history and background

The group behind Medusa is known by several aliases, including Storm-1175 and Spearwing [4] [7]. Like its mythological namesake, Medusa has many “heads,” collaborating with initial access brokers (IABs) and, according to some evidence, affiliating with Big Game Hunting (BGH) groups such as Frozen Spider, as well as the cybercriminal group UNC7885 [3][6][13].

Use of Cyrillic in its scripts, activity on Russian-language cybercrime forums, slang unique to Russian criminal subcultures, and avoidance of targets in Commonwealth of Independent States (CIS) countries suggest that Medusa operates from Russia or an allied state [11][12].

Medusa ransomware should not be confused with other similarly named malware, such as the Medusa Android Banking Trojan, the Medusa Botnet/Medusa Stealer, or MedusaLocker ransomware. It is easily distinguishable from these variants because it appends the extension .MEDUSA to encrypted files and drops the ransom note !!!READ_ME_MEDUSA!!!.txt on compromised systems [8].

Who does Medusa Ransomware target?

The group appears to show little restraint, indiscriminately attacking organizations across all sectors, including healthcare, and is known to employ triple extortion tactics whereby sensitive data is encrypted, victims are threatened with data leaks, and additional pressure is applied through DDoS attacks or contacting the victim’s customers, rather than the more common double extortion model [13].

Medusa Ransomware TTPs

To attain initial access, Medusa actors typically purchase access to already compromised devices or accounts via IABs that employ phishing, credential stuffing, or brute-force attacks, and also target vulnerable or misconfigured Internet-facing systems.

In addition to the GoAnywhere MFT and SimpleHelp RMM flaws, other vulnerabilities exploited in Medusa attacks include ConnectWise ScreenConnect RMM (CVE-2024-1709), Microsoft Exchange Server (CVE-2021-34473, also known as ProxyShell), and Fortinet Enterprise Management Servers (CVE-2023-48788) [18][19][20][21][24][25].

Darktrace’s Coverage of Medusa Ransomware

Between December 2023 and November 2025, Darktrace observed multiple cases of file encryption related to Medusa ransomware across its customer base. When enabled, Darktrace’s Autonomous Response capability intervened early in the attack chain, blocking malicious activity before file encryption could begin.

Some of the affected were based in Europe, the Middle East and Africa (EMEA), others in the Americas (AMS), and the remainder in the Asia-Pacific and Japan region. The most impacted sectors were financial services and the automotive industry, followed by healthcare, and finally organizations in arts, entertainment and recreation, ICT, and manufacturing.

Remote Monitoring and Management (RMM) tool abuse

In most customer environments where Medusa file encryption attempts were observed, and in one case where the compromise was contained before encryption, unusual external HTTP connections associated with JWrapper were also detected. JWrapper is a legitimate tool designed to simplify the packaging, distribution, and management of Java applications, enabling the creation of executables that run across different operating systems. Many of the destination IP addresses involved in this activity were linked to SimpleHelp servers or associated with Atera.

Medusa actors appear to favor RMM tools such as SimpleHelp. Unpatched or misconfigured SimpleHelp RMM servers can serve as an initial access vector to the victims’ infrastructure. After gaining access to SimpleHelp management servers, the threat actors edit server configuration files to redirect existing SimpleHelp RMM agents to communicate with unauthorized servers under their control.

The SimpleHelp tool is not only used for command-and-control (C2) and enabling persistence but is also observed during lateral movement within the network, downloading additional attack tools, data exfiltration, and even ransomware binary execution. Other legitimate remote access tools abused by Medusa in a similar manner to evade detection include Atera, AnyDesk, ScreenConnect, eHorus, N-able, PDQ Deploy/Inventory, Splashtop, TeamViewer, NinjaOne, Navicat, and MeshAgent [4][5][15][16][17].

Data exfiltration

Another correlation among Darktrace customers affected by Medusa was observed during the data exfiltration phase. In several environments, data was exfiltrated to the endpoints erp.ranasons[.]com or pruebas.pintacuario[.]mx (143.110.243[.]154, 144.217.181[.]205) over ports 443, 445, and 80. erp.ranasons[.]com was seemingly active between November 2024 and September 2025, while pruebas.pintacuario[.]mx was seen from November 2024 to March 2025. Evidence suggests that pruebas.pintacuario[.]mx previously hosted a SimpleHelp server [22][23].

Apart from RMM tools, Medusa is also known to use Rclone and Robocopy for data exfiltration [3][19]. During one Medusa compromise detected in mid-2024, the customer’s data was exfiltrated to external destinations associated with the Ngrok proxy service using an SSH-2.0-rclone client.

Medusa Compromise Leveraging SimpleHelp

In Q4 2025, Darktrace assisted a European company impacted by Medusa ransomware. The organization had partial Darktrace / NETWORK coverage and had configured Darktrace’s Autonomous Response capability to require manual confirmation for all actions. Despite these constraints, data received through the customer’s security integration with CrowdStrike Falcon enabled Darktrace analysts to reconstruct the attack chain, although the initial access vector remains unclear due to limited visibility.

In late September 2025, a device out of the scope of Darktrace's visibility began scanning the network and using RDP, NTLM/SMB, DCE_RPC, and PowerShell for lateral movement.

CrowdStrike “Defense Evasion: Disable or Modify Tools” alerts related to a suspicious driver (c:\windows\[0-9a-b]{4}.exe) and a PDQ Deploy executable (share=\\<device_hostname>\ADMIN$ file=AdminArsenal\PDQDeployRunner\service-1\exec\[0-9a-b]{4}.exe) suggest that the attackers used the Bring Your Own Vulnerable Driver (BYOVD) technique to terminate antivirus processes on network devices, leveraging tools such as KillAV or AbyssWorker along with the PDQ Software Deployment solution [19][26].

A few hours later, Darktrace observed the same device that had scanned the network writing Temp\[a-z]{2}.exe over SMB to another device on the same subnet. According to data from the CrowdStrike alert, this executable was linked to an RMM application located at C:\Users\<compromised_user>\Documents\[a-z]{2}.exe. The same compromised user account later triggered a CrowdStrike “Command and Control: Remote Access Tools” alert when accessing C:\ProgramData\JWrapper-Remote Access\JWrapper-Remote Access Bundle-[0-9]{11}\JWrapperTemp-[0-9]{10}-[0-9]{1}-app\bin\windowslauncher.exe [27].

Figure 1: An executable file associated with the SimpleHelp RMM tool being written to other devices using the SMB protocol, as detected by Darktrace.

Soon after, the destination device and multiple other network devices began establishing connections to 31.220.45[.]120 and 213.183.63[.]41, both of which hosted malicious SimpleHelp RMM servers. These C2 connections continued for more than 20 days after the initial compromise.

CrowdStrike integration alerts for the execution of robocopy . "c:\windows\\" /COPY:DT /E /XX /R:0 /W:0 /NP /XF RunFileCopy.cmd /IS /IT commands on several Windows servers, suggested that this utility was likely used to stage files in preparation for data exfiltration [19].

Around two hours later, Darktrace detected another device connecting to the attacker’s SimpleHelp RMM servers. This internal server had ‘doc’ in its hostname, indicating it was likely a file server. It was observed downloading documents from another internal server over SMB and uploading approximately 70 GiB of data to erp.ranasons[.]com (143.110.243[.]154:443).

Figure 2: Data uploaded to erp.ranasons[.]com and the number of model alerts from the exfiltrating device, represented by yellow and orange dots.

Darktrace’s Cyber AI Analyst autonomously investigated the unusual connectivity, correlating the separate C2 and data exfiltration events into a single incident, providing greater visibility into the ongoing attack.

Figure 3: Cyber AI Analyst identified a file server making C2 connections to an attacker-controlled SimpleHelp server (213.183.63[.]41) and exfiltrating data to erp.ranasons[.]com.

Figure 4: The same file server that connected to 213.183.63[.]41 and exfiltrated data to erp.ranasons[.]com was also observed attempting to connect to an IP address associated with Moscow, Russia (193.37.69[.]154:7070).

One of the devices connecting to the attacker's SimpleHelp RMM servers was also observed downloading 35 MiB from [0-9]{4}.filemail[.]com. Filemail, a legitimate file-sharing service, has reportedly been abused by Medusa actors to deliver additional malicious payloads [11].

Figure 5: A device controlled remotely via SimpleHelp downloading additional tooling from the Filemail file-sharing service.

Finally, integration alerts related to the ransomware binary, such as c:\windows\system32\gaze.exe and <device_hostname>\ADMIN$ file=AdminArsenal\PDQDeployRunner\service-1\exec\gaze.exe, along with “!!!READ_ME_MEDUSA!!!.txt” ransom notes were observed on network devices. This indicates that file encryption in this case was most likely carried out directly on the victim hosts rather than via the SMB protocol [3].

Conclusion

Threat actors, including nation-state actors and ransomware groups like Medusa, have long abused legitimate commercial RMM tools, typically used by system administrators for remote monitoring, software deployment, and device configuration, instead of relying on remote access trojans (RATs).

Attackers employ existing authorized RMM tools or install new remote administration software to enable persistence, lateral movement, data exfiltration, and ingress tool transfer. By mimicking legitimate administrative behavior, RMM abuse enables attackers to evade detection, as security software often implicitly trusts these tools, allowing attackers to bypass traditional security controls [28][29][30].

To mitigate such risks, organizations should promptly patch publicly exposed RMM servers and adopt anomaly-based detection solutions, like Darktrace / NETWORK, which can distinguish legitimate administrative activity from malicious behavior, applying rapid response measures through its Autonomous Response capability to stop attacks in their tracks.

Darktrace delivers comprehensive network visibility and Autonomous Response capabilities, enabling real-time detection of anomalous activity and rapid mitigation, even if an organization fall under Medusa’s gaze.

Credit to Signe Zaharka (Principal Cyber Analyst) and Emma Foulger (Global Threat Research Operations Lead

Edited by Ryan Traill (Analyst Content Lead)

Appendices

List of Indicators of Compromise (IoCs)

IoC - Type - Description + Confidence + Time Observed

185.108.129[.]62 IP address Malicious SimpleHelp server observed during Medusa attacks (High confidence) - March 7, 2023

185.126.238[.]119 IP address Malicious SimpleHelp server observed during Medusa attacks (High confidence) - November 26-27, 2024

213.183.63[.]41 IP address Malicious SimpleHelp server observed during Medusa attacks (High confidence) - November 28, 2024 - Sep 30, 2025

213.183.63[.]42 IP address Malicious SimpleHelp server observed during Medusa attacks (High confidence) - July 4 -9 , 2024

31.220.45[.]120 IP address Malicious SimpleHelp server observed during Medusa attacks (High confidence) - September 12 - Oct 20 , 2025

91.92.246[.]110 IP address Malicious SimpleHelp server observed during Medusa attacks (High confidence) - May 24, 2024

45.9.149[.]112:15330 IP address Malicious SimpleHelp server observed during Medusa attacks (High confidence) - June 21, 2024

89.36.161[.]12 IP address Malicious SimpleHelp server observed during Medusa attacks (High confidence) - June 26-28, 2024

193.37.69[.]154:7070 IP address Suspicious RU IP seen on a device being controlled via SimpleHelp and exfiltrating data to a Medusa related endpoint - September 30 - October 20, 2025

erp.ranasons[.]com·143.110.243[.]154 Hostname Data exfiltration destination - November 27, 2024 - September 30, 2025

pruebas.pintacuario[.]mx·144.217.181[.]205 - Hostname Data exfiltration destination - November 27, 2024 - March 26, 2025

lirdel[.]com · 44.235.83[.]125/a.msi (1b9869a2e862f1e6a59f5d88398463d3962abe51e19a59) File & hash Atera related file downloaded with PowerShell - June 20, 2024

wizarr.manate[.]ch/108.215.180[.]161:8585/$/1dIL5 File Suspicious file observed on one of the devices exhibiting unusual activity during a Medusa compromise - February 28, 2024

!!!READ_ME_MEDUSA!!!.txt" File - Ransom note

*.MEDUSA - File extension File extension added to encrypted files

gaze.exe – File - Ransomware binary

Darktrace Model Coverage

Darktrace / NETWORK model detections triggered during connections to attacker controlled SimpleHelp servers:

Anomalous Connection/Anomalous SSL without SNI to New External

Anomalous Connection/Multiple Connections to New External UDP Port

Anomalous Connection/New User Agent to IP Without Hostname

Anomalous Connection/Rare External SSL Self-Signed

Anomalous Connection/Suspicious Self-Signed SSL

Anomalous File/EXE from Rare External Location

Anomalous Server Activity/Anomalous External Activity from Critical Network Device

Anomalous Server Activity/New User Agent from Internet Facing System

Anomalous Server Activity/Outgoing from Server

Anomalous Server Activity/Rare External from Server

Compromise/High Volume of Connections with Beacon Score

Compromise/Large Number of Suspicious Failed Connections

Compromise/Ransomware/High Risk File and Unusual SMB

Device/New User Agent

Unusual Activity/Unusual External Data to New Endpoint

Unusual Activity/Unusual External Data Transfer

Darktrace / NETWORK Model Detections during the September/October 2025 Medusa attack:

Anomalous Connection / Data Sent to Rare Domain

Anomalous Connection / Download and Upload

Anomalous Connection / Low and Slow Exfiltration

Anomalous Connection / New User Agent to IP Without Hostname

Anomalous Connection / Uncommon 1 GiB Outbound

Anomalous Connection / Unusual Admin RDP Session

Anomalous Connection / Unusual Incoming Long Remote Desktop Session

Anomalous Connection / Unusual Long SSH Session

Anomalous File / EXE from Rare External Location

Anomalous File / Internal/Unusual Internal EXE File Transfer

Anomalous Server Activity / Anomalous External Activity from Critical Network Device

Anomalous Server Activity / Outgoing from Server

Anomalous Server Activity / Rare External from Server

Compliance / Default Credential Usage

Compliance / High Priority Compliance Model Alert

Compliance / Outgoing NTLM Request from DC

Compliance / Possible Unencrypted Password File On Server

Compliance / Remote Management Tool On Server

Compromise / Large Number of Suspicious Failed Connections

Compromise / Large Number of Suspicious Successful Connections

Compromise / Ransomware/High Risk File and Unusual SMB

Compromise / Suspicious Beaconing Behaviour

Compromise / Suspicious HTTP and Anomalous Activity

Compromise / Sustained SSL or HTTP Increase

Compromise / Sustained TCP Beaconing Activity To Rare Endpoint

Device / ICMP Address Scan

Device / Increase in New RPC Services

Device / Initial Attack Chain Activity

Device / Large Number of Model Alert

Device / Large Number of Model Alerts from Critical Network Device

Device / Lateral Movement and C2 Activity

Device / Multiple C2 Model Alert

Device / Network Scan

Device / Possible SMB/NTLM Reconnaissance

Device / Spike in LDAP Activity

Device / Suspicious Network Scan Activity

Device / Suspicious SMB Scanning Activity

Security Integration / High Severity Integration Incident

Security Integration / Low Severity Integration Incident

Unusual Activity / Enhanced Unusual External Data Transfer

Unusual Activity / Internal Data Transfer

Unusual Activity / Unusual External Activity

Unusual Activity / Unusual External Data to New Endpoint

Unusual Activity / Unusual External Data Transfer

User / New Admin Credentials on Server

Autonomous Response Actions

Antigena / Network/External Threat/Antigena File then New Outbound Block

Antigena / Network/External Threat/Antigena Ransomware Block

Antigena / Network/External Threat/Antigena Suspicious Activity Block

Antigena / Network/External Threat/Antigena Suspicious File Block

Antigena / Network/Insider Threat/Antigena Internal Anomalous File Activity

Antigena / Network/Insider Threat/Antigena Internal Data Transfer Block

Antigena / Network/Insider Threat/Antigena Large Data Volume Outbound Block

Antigena / Network/Insider Threat/Antigena Network Scan Block

Antigena / Network/Insider Threat/Antigena Unusual Privileged User Activities Block

Antigena / Network/Significant Anomaly/Antigena Alerts Over Time Block

Antigena / Network/Significant Anomaly/Antigena Controlled and Model Alert

Antigena / Network/Significant Anomaly/Antigena Enhanced Monitoring from Server Block

Antigena / Network/Significant Anomaly/Antigena Significant Server Anomaly Block

Antigena / Network/Significant Anomaly/Repeated Antigena Alerts

MITRE ATT&CK Mapping

Technique Name, Tactic, ID, Sub-Technique

Application Layer Protocol , COMMAND AND CONTROL , T1071

Automated Collection , COLLECTION , T1119

Automated Exfiltration , EXFILTRATION , T1020

Brute Force , CREDENTIAL ACCESS , T1110

Client Configurations , RECONNAISSANCE , T1592.004 , T1592

Cloud Accounts , DEFENSE EVASION , PERSISTENCE , PRIVILEGE ESCALATION , INITIAL ACCESS , T1078.004 , T1078

Command-Line Interface , EXECUTION ICS , T0807

Credential Stuffing , CREDENTIAL ACCESS , T1110.004 , T1110

Data Encrypted for Impact , IMPACT , T1486

Data from Network Shared Drive , COLLECTION , T1039

Data Obfuscation , COMMAND AND CONTROL , T1001

Data Staged , COLLECTION , T1074

Data Transfer Size Limits , EXFILTRATION , T1030

Default Accounts , DEFENSE EVASION , PERSISTENCE , PRIVILEGE ESCALATION , INITIAL ACCESS , T1078.001 , T1078

Default Credentials , LATERAL MOVEMENT ICS , T0812

Distributed Component Object Model , LATERAL MOVEMENT , T1021.003 , T1021

Drive-by Compromise , INITIAL ACCESS ICS , T0817

Drive-by Compromise , INITIAL ACCESS , T1189

Email Collection , COLLECTION , T1114

Exfiltration Over Alternative Protocol , EXFILTRATION , T1048

Exfiltration Over C2 Channel , EXFILTRATION , T1041

Exfiltration to Cloud Storage , EXFILTRATION , T1567.002 , T1567

Exploit Public-Facing Application , INITIAL ACCESS , T1190

Exploitation for Privilege Escalation , PRIVILEGE ESCALATION , T0890

Exploitation of Remote Services , LATERAL MOVEMENT , T1210

Exploits , RESOURCE DEVELOPMENT , T1588.005 , T1588

File and Directory Discovery , DISCOVERY , T1083

File Deletion , DEFENSE EVASION , T1070.004 , T1070

Graphical User Interface , EXECUTION ICS , T0823

Ingress Tool Transfer , COMMAND AND CONTROL , T1105

Lateral Tool Transfer , LATERAL MOVEMENT , T1570

LLMNR/NBT-NS Poisoning and SMB Relay , CREDENTIAL ACCESS , COLLECTION , T1557.001 , T1557

Malware , RESOURCE DEVELOPMENT , T1588.001 , T1588

Network Service Scanning , DISCOVERY , T1046

Network Share Discovery , DISCOVERY , T1135

Non-Application Layer Protocol , COMMAND AND CONTROL , T1095

Non-Standard Port , COMMAND AND CONTROL , T1571

One-Way Communication , COMMAND AND CONTROL , T1102.003 , T1102

Pass the Hash , DEFENSE EVASION , LATERAL MOVEMENT , T1550.002 , T1550

Password Cracking , CREDENTIAL ACCESS , T1110.002 , T1110

Password Guessing , CREDENTIAL ACCESS , T1110.001 , T1110

Password Spraying , CREDENTIAL ACCESS , T1110.003 , T1110

Program Download , LATERAL MOVEMENT ICS , T0843

Program Upload , COLLECTION ICS , T0845

Remote Access Software , COMMAND AND CONTROL , T1219

Remote Desktop Protocol , LATERAL MOVEMENT , T1021.001 , T1021

Remote System Discovery , DISCOVERY , T1018

Scanning IP Blocks , RECONNAISSANCE , T1595.001 , T1595

Scheduled Transfer , EXFILTRATION , T1029

Spearphishing Attachment , INITIAL ACCESS ICS , T0865

Standard Application Layer Protocol , COMMAND AND CONTROL ICS , T0869

Supply Chain Compromise , INITIAL ACCESS ICS , T0862

User Execution , EXECUTION ICS , T0863

Valid Accounts , DEFENSE EVASION , PERSISTENCE , PRIVILEGE ESCALATION , INITIAL ACCESS , T1078

Valid Accounts , PERSISTENCE ICS , LATERAL MOVEMENT ICS , T0859

Vulnerabilities , RESOURCE DEVELOPMENT , T1588.006 , T1588

Vulnerability Scanning , RECONNAISSANCE , T1595.002 , T1595

Web Protocols , COMMAND AND CONTROL , T1071.001 , T1071

References

1. https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware

2. https://www.ransomware.live/group/medusa

3. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a

4. https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/

5. https://zensec.co.uk/blog/how-rmm-abuse-fuelled-medusa-dragonforce-attacks/

6. https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/medusa-ransomware-group/

7. https://cyberpress.org/medusa-ransomware-attacks-spike-42/

8. https://blog.barracuda.com/2025/02/25/medusa-ransomware-and-its-cybercrime-ecosystem

10. https://www.cyberdaily.au/security/10021-more-monster-than-myth-unpacking-the-medusa-ransomware-operation

11. https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/

12. https://www.bitdefender.com/en-us/blog/businessinsights/medusa-ransomware-a-growing-threat-with-a-bold-online-presence

13. https://redpiranha.net/news/medusa-ransomware-everything-you-need-know

14. https://www.theregister.com/2025/03/13/medusa_ransomware_infects_300_critical/

15. https://www.s-rminform.com/latest-thinking/cyber-threat-advisory-medusa-and-the-simplehelp-vulnerability

16. https://nagomisecurity.com/medusa-ransomware-us-cert-alert

17. https://arcticwolf.com/resources/blog/arctic-wolf-observes-campaign-exploiting-simplehelp-rmm-software-for-initial-access/

18. https://securityboulevard.com/2025/04/medusa-ransomware-inside-the-2025-resurgence-of-one-of-the-internets-most-aggressive-threats/

19. https://thehackernews.com/2025/03/medusa-ransomware-hits-40-victims-in.html

20. https://www.quorumcyber.com/threat-intelligence/critical-alert-medusa-ransomware-threat-highlighted-by-fbi-cisa-and-ms-isac/

21. https://brandefense.io/blog/stone-gaze-in-depth-analysis-of-medusa-ransomware/

22. https://www.darktrace.com/ja/blog/2025-cyber-threat-landscape-darktraces-mid-year-review

23. https://www.joesandbox.com/analysis/1576447/0/html

24. https://blog.barracuda.com/2025/02/25/medusa-ransomware-and-its-cybercrime-ecosystem

25. https://shassit.mit.edu/news/medusa-ransomware-attacks-on-gmail/

26. https://thehackernews.com/2025/03/medusa-ransomware-uses-malicious-driver.html

27. https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a

28. https://www.catonetworks.com/blog/cato-ctrl-investigation-of-rmm-tools/

29. https://redcanary.com/threat-detection-report/trends/rmm-tools/

30. https://www.proofpoint.com/us/blog/threat-insight/remote-monitoring-and-management-rmm-tooling-increasingly-attackers-first-choice

Written by

Signe Zaharka

Principal Cyber Analyst

Inside the SOC

Written by

Signe Zaharka

Principal Cyber Analyst

Watch the NIS2 Webinar

Blog

June 25, 2026

Shadow AI Detection: The First Step Toward Securing AI

Why shadow AI is emerging

Imagine you’re an employee under pressure, deadlines stacking up, repetitive tasks piling higher by the day. You find a free AI tool online that promises to automate the work in seconds; no approvals are needed. It feels like a simple win, paste in some data, write a quick prompt, and move faster.

But in that moment, something changed.

Sensitive customer information is entered into a tool your organization doesn’t monitor, doesn’t govern, and can’t see and suddenly, that data is no longer where it should be, and no one knows where it’s gone.

This is the reality of Shadow AI: employees using unsanctioned AI tools to move faster, while unintentionally creating risk that exists entirely outside visibility and control.

This is not just a one off case, research across businesses indicate that nearly half of employees report using unsanctioned AI tools, often prioritizing speed and productivity over security. Additionally, 51% of employees report connecting AI tools to work systems or apps without IT approval, creating significant operational risk where the average cost of security incidents in organizations with a high level of shadow AI usage can reach $670k.

While shadow AI is often top of mind for security professionals, it is just one component of how AI use can increase risk. Understanding and managing shadow AI use should be considered as part of a broader, comprehensive risk management strategy that aims to secure AI systems, including human and agent identities, interactions, human-AI partnerships, and behaviors operating across the digital enterprise from visibility and governance through detection, response, and recovery.

Effective risk management calls for a layered and interdisciplinary strategy. It requires addressing issues across governance and visibility; identity, access and agent control, data security and privacy, secure MLOps / LLMOps, runtime security, behavior-based detection, autonomous response and recovery.

This blog explores a specific governance and visibility use case linked to shadow AI and reveals the challenges it presents as well as the defensive strategies that security teams can adopt.

Why shadow AI is hard to detect

When it comes to AI, what organizations can easily see does not always reflect the full scope of AI activity occurring within the tools, applications, and workflows used across an enterprise. As a result, organizations using traditional rule-based methods to flag unusual activity may struggle to distinguish unsanctioned AI usage from legitimate operational behavior, particularly as SaaS applications, APIs, and orchestration layers increasingly have AI embedded into normal business workflows. Identifying threats using previously observed intelligence or depending on hard to maintain allow and block lists does not provide a dynamic enough strategy to manage risk. Also, many organizations are focusing on identifying Shadow AI in their governed infrastructure, like gateways, endpoints, or SASE, which is foundational. But, organizations require visibility and Shadow AI detection across all networked infrastructure from on-prem, hybrid, data centers, and cloud infrastructure that may not have endpoint agent visibility. This uncovers the utilization of MCP, data flows, and autonomous agents across these domains.

For example, employees interact with AI assistants across approved SaaS platforms every day. However, browser extensions and other types of plug-ins can route prompts that include enterprise data to embedded AI services in ways that are not visible to the security team. AI enabled workflows may invoke multiple APIs, orchestration layers, and cloud services behind the scenes, making it difficult for traditional security tooling to determine where data is processed, stored, or retransmitted. Because much of this activity occurs within trusted browser sessions and encrypted SaaS traffic, conventional network monitoring, DLP, and application allowlisting controls often lack the context needed to accurately identify or govern these interactions

Identifying AI tools in the environment is one part of the equation. Understanding the behavior surrounding their use is where the real challenge lies. An AI application is not inherently risky, but the way users or other assets interact with it may be. Sensitive data exposure, abnormal access patterns, and misuse of AI-assisted workflows often appear legitimate in isolation and only become visible through behavioral analysis across the broader environment.

What Shadow AI visibility does and doesn’t show

Comprehensive Shadow AI visibility allows organizations to answer several important questions:

What types of AI are we using? What AI platforms, agents, MCP clients/servers, and services are active across the enterprise?

Who is using AI services? Which users, business units, or systems are interacting with those AI services?

Is our data safe? Is sensitive or regulated data being exposed through prompts, workflows, or integrations?

Are AI systems behaving as expected? Are AI systems behaving anomalously or operating outside approved governance processes?

Are our AI systems under attack? Is an attacker attempting to manipulate prompts, influence agent behavior, or abuse AI-enabled workflows?

Answering these questions is foundational to broader AI governance efforts. However, it is limited to helping teams understand initial interactions and fails to offer insight into dependencies and outcomes that are critical to securing AI across an enterprise.

Deeper visibility that includes the ability to understand dependencies and outcomes are not always available in AI security point products. Answering the questions below requires understanding runtime behavior and operational outcomes:

What actions did the AI interaction trigger?

What systems, applications, or data did it access? Did the AI operate beyond its intended permissions or scope?

Could a low-risk interaction lead to high-risk outcomes?

What is the risk and context understanding of an anomalous activity to assist in prioritization of analysis and autonomous response action?

The distinction between these two sets of questions offers two different layers of AI security. The first set of questions focuses on discovery and interaction visibility. The second set focuses on providing visibility that includes the context and outcomes that are critical for managing follow-on risks associated with obfuscated downstream activities.

Together, these layers help organizations move beyond simply identifying AI usage toward understanding how AI behaves operationally across the enterprise.

How organizations are addressing shadow AI

Most organizations still approach shadow AI as an application control problem, relying on policies, browser restrictions, and allow/block lists. However, AI adoption is evolving faster than most governance processes can realistically keep pace with. New assistants, plugins, and embedded AI features appear continuously, creating pressure to enable business productivity while simultaneously containing risk.

Existing governance processes were designed for a more traditional SaaS adoption cycle, where new applications could be reviewed, approved, and monitored over longer time horizons. AI adoption operates differently. New capabilities can appear overnight inside existing platforms employees already use, making it difficult for security and governance teams to maintain an accurate understanding of enterprise AI exposure. This means that many organizations are experiencing significant operational overhead, particularly in large environments where AI usage is decentralized across teams, departments, and third-party services.

Where should organizations start when securing their AI systems?

Shadow AI identification is an on-going critical component for AI Risk/Governance Boards as well as security organizations. As organizations seek AI certifications like ISO 42001 AI Management Systems, visibility into all AI adoption from enterprise use to custom innovation and development is crucial. Shadow AI identification provides organizations with the visibility needed to decide whether an AI tool should be brought into governed environments to reduce data loss (DLP) risks or whether policies should be established and enforced to restrict their use.

As organizations rapidly innovate and adopt AI, they are taking on more and more risk. Organizations need to have a strategy in place to mitigate the assumed risk, especially with third-party adoption. Visibility, monitoring, governance enforcement, behavioral-based detection of non-deterministic systems, and autonomous investigation and containment becomes critical to mitigating the risk of AI systems.

How Darktrace secures AI and shadow AI

Attackers are using AI to move faster, scale tactics, and make threats more adaptive and convincing. Internally, organizations are grappling with new forms of risk created by generative AI, autonomous agents, shadow AI, and increasingly complex digital environments.

Darktrace helps organizations protect both people and AI in a world where AI is now central to how business gets done. Darktrace / SECURE AI helps organizations discover and control shadow AI by surfacing unsanctioned or unexpected AI activity where it appears – including MCP detections, distinguishing misuse of legitimate tools and unapproved services, and applying policy to contain data exposure while guiding users toward sanctioned options.

Stay up to date on AI security

Sign up for the Secure AI Readiness Program here: This gives you exclusive access to the latest news on the latest AI threats, updates on emerging approaches shaping AI security, and insights into the latest innovations, including Darktrace’s ongoing work in this area.

Ready to talk with a Darktrace expert on securing AI? Register here to receive practical guidance on the AI risks that matter most to your business, paired with clarity on where to focus first across governance, visibility, risk reduction, and long-term readiness.

About the author

Blog

Network

June 25, 2026

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

Introduction

Darktrace’s Threat Research team is publishing this analysis to help defenders understand an active pattern of macOS tradecraft observed in multiple customer environments. This post summarizes the behaviors observed, how they were assessed, and what defenders can do now.

Across multiple environments, Darktrace observed a consistent MacOS intrusion pattern beginning with ClickFix-style user-assisted “update” execution and transitioning into AppleScript-driven post-compromise activity and sustained outbound signaling.

While individual indicators were low-confidence, the repeated convergence of weak behavioral signals — including HTTP POST beaconing, rare or IP-only destinations, SSL anomalies, and abnormal client characteristics — provided a defensible indication of command-and-control establishment Darktrace detection and response in these cases was driven by behavior over artifacts. In the highest-confidence instances, automated containment disrupted outbound signaling before sustained tasking could occur.

Background

ClickFix-style activity typically relies on user-assisted execution and plausible “update” pretexting, followed by post-execution use of native tools to keep the footprint light. In MacOS environments, AppleScript and other built-in scripting mechanisms enable flexible post-compromise workflows while minimizing stable file-based indicators.

Following execution, affected devices exhibited a consistent behavioral pattern. AppleScript or equivalent native scripting activity was observed initiating follow-on workflows, after which outbound communications began to establish a structured rhythm.

These communications were characterized by repeated HTTP POST requests to low-prevalence or IP-only endpoints, often combined with unusual SSL properties and client identifiers that diverged from baseline device behavior. Individually, these signals were weak. When correlated across time and devices, they formed a pattern consistent with control establishment rather than benign software activity.

In higher-confidence cases, Autonomous Response actions were able to reduce or halt outbound signaling, interrupting the attacker’s ability to maintain control.

Detection Timeline

In representative cases, the sequence unfolded as follows:

Stage 1 – Initial Execution

Initial activity began with suspicious or masqueraded execution on a MacOS endpoint, consistent with ClickFix-style user deception.

Stage 2 – Post-Execution Scripting

This was followed closely by native scripting activity, most commonly AppleScript, indicating the transition into post-execution workflow.

Stage 3 – Outbound Communications

Outbound communications then emerged, initially sporadic but quickly forming a consistent cadence of HTTP POST requests to rare external endpoints.

Stage 4 – Anomaly Convergence

As activity persisted, additional anomalies became visible — unusual SSL characteristics, abnormal user agents, and connections to infrastructure with no prior network prevalence.

Stage 5 – Autonomous Response

In the most mature stages of the activity, automated containment actions disrupted outbound communications on affected devices, limiting the attacker’s ability to continue tasking while investigations progressed.

Darktrace coverage and detections

The following use-case highlights systems likely affected by malicious macOS intrusion activity linked by Microsoft to the Democratic People’s Republic of Korea (DPRK) [1], with indications of suspicious behavior observed between March 1 and May 3, 2026. The activity overlaps with patterns described in recent reporting on DPRK-nexus MacOS intrusions [1], though attribution confidence in this case remains moderate and based on behavioral alignment rather than solely infrastructure linkage.

Analyst confidence emerged through the correlation of multiple weak signals across time and devices. This included model coverage for rare external communications, sustained beaconing patterns, repeated HTTP POSTs, and anomalous client characteristics. Where enabled, Autonomous Response actions disrupted the most active outbound paths to reduce the attacker’s ability to maintain control while Darktrace’s investigation continued.

Notably, this highly anomalous behavior included:

Outbound connections to the rare external endpoint, zoom[.]uswebob[.]us associated with IP address, 148.72.73[.]98 [2][3] over port 443
Outbound connections to the rare external endpoint, check02id[.]com associated with IP address, 83.136.210[.]180 [4] over port 7365
Outbound connections to the rare external endpoints, 104.145.210[.]107 [5] over port 8443 and 83.136.208[.]48 [6] over port 443
Outbound connections to the rare external endpoint, 83.136.208[.]246 [7] over port 6783 with observed URI `/api/daemon` and a PowerShell user agent

Darktrace’s detection initially highlighted a desktop device (running MacOS) engaging in anomalous behavior as early as March 12, 2026. Starting on March 12, the source device triggered a ‘Possible Doppelganger Attack’ alert including connectivity to the hostname "zoom[.]uswebob[.]us · 148.72.73[.]98" over port 443 (TCP, HTTPS, H2). This model highlights a device connecting to a location that is rare but masquerades as legitimate software, such as Zoom in this case, a commonly used technique to blend into expected traffic [2] [3].

Figure 1: Initial connectivity observed to the rare external hostname, zoom[.]uswebob[.]us · 148.72.73[.]98, over port 443.

This was followed roughly seven later by a connection to 104.145.210[.]107 over port 8443, during which approximately 250 KiB of data of inbound data and 30 MiB of outbound data was observed, triggering the ‘Unusual Activity / Unusual External Data to New Endpoint’ in Darktrace.

Quickly after this connection, Darktrace’s Autonomous Response intervened, blocking the device’s access to the unusual external location and halting the data exfiltration attempt.

Figure 2: Darktrace’s detection of unusual data exfiltration, shortly followed by an Autonomous Response action to block it.

The device continued to consistently trigger model alerts relating to unusual external connectivity, including 'Posting HTTP to IP Without Hostname', 'Anomalous Connection / Rare External SSL Self-Signed' alerts, until well after 3 PM that day.

Figure 3: Additional external connectivity to new IP without a hostname, including connectivity to 83.136.208[.]246, alongside an anomalous ‘curl/8.7.1’ user agent and ‘/api/daemon’ URI.

Figure 4: Continued external SSL connectivity to IP 83.136.208[.]48, including connectivity to 83.136.208[.]246, alongside an anomalous ‘curl/8.7.1’ user agent and ‘/api/daemon’ URI.

Figure 5: Continued external HTTP connectivity to hostname, check02id[.]com · 83.136.210[.]180, alongside an anomalous ‘Go-http-client/1,1’ user agent.

From March 13 to March 28, the device continued exhibit unusual connectivity to various endpoints (e.g., 83.136.208[.]48, 83.136.208[.]246, check02id[.]com · 83.136.210[.]180), with the 'Multiple HTTP POSTs to Rare Hostname' model consistently triggering.

Windows OS Case

Pivoting over to an additional device, this time running Windows OS, anomalous behavior was also observed between March 30 and April 20. Notably, on March 30, the device was observed making a large number of suspicious external connection attempts to 83.136.208[.]246 over port 6783, all of which failed.

A further indicator was observed on April 1 with PowerShell connectivity to the same rare endpoint (83.136.208[.]246, port 6783), using the URI '/api/daemon' and the user agent 'Mozilla/5.0 (Windows NT; Windows NT 10.0; fr-FR) WindowsPowerShell/5.1.26100.7920'. Additional alerts included 'New User Agent to IP Without Hostname' and 'Anomalous Github Download', alongside activity involving the same endpoint.

Figure 6 : ‘Anomalous Powershell to Rare External Destination’ and ‘Github Download’ model alerts. This behavior involved connectivity with the endpoints ‘83.136.208[.]246’ and ‘github[.]com’.

The device continued triggering 'Posting HTTP to IP Without Hostname' & 'PowerShell to External Rare' alerts between April 4 and April 20 across multiple related endpoints (i.e., 83.136.208[.]48, 83.136.208[.]246, check02id[.]com · 83.136.210[.]180).

Darktrace’s Autonomous Response capability was able to block suspicious PowerShell attempts to unusual external locations, as shown below in an example from April 20.

Figure 7: Autonomous Response intervening to block an unusual PowerShell connection to an external destination.

Cyber AI Analyst investigations

In higher-confidence instances, Darktrace’s Cyber AI Analyst investigations helped connect otherwise separate model alerts into a single incident narrative, highlighting the attacker’s progression from post-execution scripting into sustained outbound signaling. This contextual stitching is particularly valuable in macOS scenarios where static artefacts are limited, and behavioral sequencing defines the intrusion.

Cyber AI Analyst investigations highlighted alerts on March 12, including unusual repeated connections and possible SSL command-and-control (C2) to multiple endpoints:

Figure 8: Cyber AI Analyst investigation linking events into a unified incident.

Autonomous Response

In addition to the containment actions detailed earlier, Autonomous Response implemented multiple additional measures to contain suspicious activity throughout the course of this attack. Whenever unusual external connectivity was detected, Darktrace blocked it, closing down potential C2 channels. Likewise, when data exfiltration attempts were identified, these connections were stopped to prevent the potential loss of sensitive data.

Furthermore, in cases where a device was deemed to have carried out a significant number of anomalous activities, Darktrace enforced a “pattern of life” on the device, preventing it from deviating from its expected behavior while allowing legitimate business operations to continue uninterrupted.

Figure 10: Autonomous Response actions implemented by Darktrace in response to suspicious connectivity in April, including the “Enforce Pattern of Life” action.

Conclusion

macOS intrusion tradecraft continues to shift toward native tooling and lightweight control channels designed to evade signature-led controls.

The repeated convergence of rare destinations, POST-based signaling, and anomalous client behavior — observed across time and across devices — provided sufficient evidence to act early and with confidence.

As macOS tradecraft continues to evolve, the defender advantage increasingly lies not in signatures, but in the ability to reason from behavior.

‍

Credit to Justin Torres (Senior Cyber Analyst), Nathaniel Jones (VP, Security & AI Strategy, FCISO)

Edited by Ryan Traill (Content Manager)

Appendices

Darktrace Model Alert Coverage:

/ NETWORK-based model alerts:

· Anomalous Connection::Multiple HTTP POSTs to Rare Hostname

· Anomalous Connection::Rare External SSL Self-Signed

· Anomalous Connection::Powershell to Rare External

· Anomalous Connection::New User Agent to IP Without Hostname

· Anomalous Connection::Posting HTTP to IP Without Hostname

· Compromise::Fast Beaconing to DGA

· Compromise::Large Number of Suspicious Failed Connections

· Device::Anomalous Github Download

· Device::New PowerShell User Agent

· Unusual Activity::Unusual External Data to New Endpoint

/ NETWORK-based Autonomous Response model alerts:

· Antigena / Network::Significant Anomaly::Antigena Significant Anomaly from Client Block

· Antigena / Network::Significant Anomaly::Antigena Controlled and Model Breach

· Antigena / Network::Significant Anomaly::Antigena Breaches Over Time Block

Indicators of Compromise (IoCs)

IP/Hostname:

· zoom[.]uswebob[.]us · 148.72.73[.]98

· 83.136.208[.]246

· check02id[.]com · 83.136.210[.]180

· 83.136.208[.]48

· 104.145.210[.]107

URIs:

· /api/daemon

Destination Port Usage:

· 6783

· 5202

· 443

· 7365

· 8443

ASN:

· AS400897 PETROSKY

· AS398256 AS-ULTAHOST

User agents:

· Mozilla/5.0 (Windows NT; Windows NT 10.0; fr-FR) WindowsPowerShell/5.1.26100.7920

· Go-http-client/1.1

· curl/8.7.1

MITRE ATT&CK Mapping

(Technique Name - Tactic - ID - Sub-Technique of)

· Browser Session Hijacking - COLLECTION - T1185

· Web Protocols - COMMAND AND CONTROL - T1071.001 - T1071

· Install Digital Certificate - RESOURCE DEVELOPMENT - T1608.003 - T1608

· PowerShell - EXECUTION - T1059.001 - T1059

· Domain Generation Algorithms - COMMAND AND CONTROL - T1568.002 - T1568

· Non-Standard Port - COMMAND AND CONTROL - T1571

· Malware - RESOURCE DEVELOPMENT - T1588.001 - T1588

· Web Service - COMMAND AND CONTROL - T1102

· Code Repositories - COLLECTION - T1213.003 - T1213

· Exploitation of Remote Services - LATERAL MOVEMENT - T1210

· Exfiltration Over C2 Channel - EXFILTRATION - T1041

· Exfiltration to Cloud Storage - EXFILTRATION - T1567.002 - T1567

References:

[1] https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/

[2] https://radar.securityalliance.org/advisory-on-dprk-unc1069-fake-microsoft-teams-and-zoom-calls/

[3] https://www.virustotal.com/gui/domain/uswebob.us

[4] https://www.virustotal.com/gui/ip-address/83.136.210.180/community

[5] https://www.virustotal.com/gui/ip-address/104.145.210.107/community

[6] https://www.virustotal.com/gui/ip-address/83.136.208.48/community

[7] https://www.virustotal.com/gui/ip-address/83.136.208.246/community

[8] https://www.darktrace.com/blog/applescript-abuse-unpacking-a-macos-phishing-campaign

About the author

Justin Torres

Cyber Analyst

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Check out this article by Darktrace: Medusa Ransomware 2025: RMM Abuse in Ransomware Campaigns

Under Medusa’s Gaze: How Darktrace Uncovers RMM Abuse in Ransomware Campaigns

What is Medusa Ransomware in 2025?

Medusa Ransomware history and background

Who does Medusa Ransomware target?

Medusa Ransomware TTPs

Darktrace’s Coverage of Medusa Ransomware

Remote Monitoring and Management (RMM) tool abuse

Data exfiltration

Medusa Compromise Leveraging SimpleHelp

Conclusion

Appendices

List of Indicators of Compromise (IoCs)

Darktrace Model Coverage

Autonomous Response Actions

MITRE ATT&CK Mapping

References

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

Shadow AI Detection: The First Step Toward Securing AI

Enjoying the blog?

More in this series

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

Hola VPN Abuse: From Proxy Traffic to Malware and Cryptomining

How Attackers Abuse the Chinese Nezha Monitoring Tool

Blog

June 25, 2026

Shadow AI Detection: The First Step Toward Securing AI

Why shadow AI is emerging

Why shadow AI is hard to detect

What Shadow AI visibility does and doesn’t show

How organizations are addressing shadow AI

Where should organizations start when securing their AI systems?

How Darktrace secures AI and shadow AI

Stay up to date on AI security

Blog

Network

June 25, 2026

From Click to Command: Behavioral Detection of AppleScript-Led MacOS Intrusions

Introduction

Background

Detection Timeline

Darktrace coverage and detections

Windows OS Case

Cyber AI Analyst investigations

Autonomous Response

Conclusion

Appendices

Darktrace Model Alert Coverage:

Indicators of Compromise (IoCs)

MITRE ATT&CK Mapping

References: