Medusa Ransomware

Ransomware first identified in 2022 that is distinct from the similarly named ransomware family MedusaLocker.

Medusaransomware family

Deletes shadow copies

Ransomware often targets backup files to inhibit system recovery.

Renames multiple (8848) files with added filename extension

This suggests ransomware activity of encrypting all the files on the system.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.