Medusa and the Ransomware Playbook of 2025

In March 2025, US authorities issued a joint advisory on the Medusa ransomware operation, detailing its tactics against organizations across multiple sectors. The advisory is a useful window into how ransomware-as-a-service groups operate in 2025, and the techniques translate directly to the threat landscape Canadian organizations face.

How the modern crews work

Groups like Medusa run a service model: developers maintain the malware while affiliates carry out intrusions and share the proceeds. Initial access commonly comes from phishing and, increasingly, from exploiting unpatched internet-facing systems. Once inside, affiliates use living-off-the-land techniques, legitimate remote-access tools, and stolen credentials to move quietly before deploying encryption.

Double extortion is standard

Attackers now steal data before encrypting it, then threaten to publish it if the ransom goes unpaid. That means a solid backup no longer fully protects you.

• Exploited edge devices and weak remote access are frequent entry points.
• Legitimate tools are abused to blend in with normal activity.
• Exfiltration precedes encryption, so data protection matters as much as recovery.

Defensive priorities

Patch internet-facing systems promptly. Enforce phishing-resistant multi-factor authentication everywhere it fits. Maintain offline, tested backups that an intruder cannot reach and encrypt. Segment networks so a single compromise cannot spread unchecked. Invest in the ability to detect the quiet middle of an attack, monitoring for unusual remote-access tool usage, mass credential activity, and large outbound data transfers.

Takeaway

Ransomware in 2025 steals your data before it locks it, so backups alone are not enough. Close off edge and remote-access entry points, enforce strong authentication, keep tested offline backups, and build detection for the lateral-movement phase where you can still stop the attack.