Medusa gang is a ransomware_group tracked across 1 threat cluster and 1 intelligence report mention on ThreatCluster. First observed November 11, 2025; most recent activity November 11, 2025.
Medusa gang is a ransomware actor operating within the ransomware-as-a-service ecosystem, known for deploying double-extortion tactics and leveraging affiliate partners to target enterprises. It is considered a persistent member of the broader ransomware threat landscape, and its activity is noted within analyses of the Q3 2025 threat environment. The referenced article frames Medusa as part of the rising ransomware activity in that period.
On November 19, 2025, the United States, United Kingdom, and Australia announced coordinated sanctions against the Russian web company Media Land, accusing it of facilitating ransomware operations. The sanctions include…