Threat Intelligence Tarot
Vol. II · 134
Criminal (RaaS)
★★★★★
risk 4/5
✦ The Petrifying Gaze ✦
Medusa
MedusaLocker-distinct · Medusa Blog
EducationManufacturingHealthcareTechnologyPublic sector
Active since ~2021 · Extortion, Financial gain
The Petrifying Gaze does not negotiate behind closed doors. It posts the countdown publicly, freezes the victim's resolve with each passing hour, and lets the watchers vote on the outcome.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆Minneapolis Public Schools breach and data leak (2023)
- ◆Toyota Financial Services intrusion (2023)
- ◆Public Medusa Blog data-leak site with countdown timers
- ◆CISA #StopRansomware joint advisory (AA25-071A, 2025)
Defenses
- ▸Leak-site monitoring as supplementary breach detectionNIST CSF: DE.CM ↗
- ▸Phishing-resistant MFA on all remote access and VPN gatewaysNIST SP 800-63B ↗
- ▸Immutable backups segregated from production credentialsCIS Control 11 ↗
- ▸Public-facing application patch SLAs with priority on known-exploited CVEsCISA KEV Catalog
Reversed: Their Weakness
Public leak sites are a double edge — defenders monitoring them can detect breaches their own SOCs missed. Cross-organizational subscription to leak-site feeds turns the operator's theatre into early warning.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.