Medusa Ransomware Campaigns Abuse SimpleHelp and Other RMM Tools

Jan 8, 2026 · Original article ↗

Summary

Darktrace describes Medusa ransomware activity across its customers, detailing how attackers abused RMM tools for access, persistence, lateral movement and data theft, including a 2025 compromise that exfiltrated about 70 GiB.

Key points

Darktrace observed Medusa-related file encryption activity across customer environments between December 2023 and November 2025.
In a late-2025 incident, attackers used network scanning, RDP, SMB, DCE/RPC and PowerShell for lateral movement; the initial access method was unclear.
Attackers used SimpleHelp and other legitimate RMM tools for command-and-control, persistence, lateral movement, tool delivery and ransomware execution.
In the investigated incident, a file server uploaded about 70 GiB of data to erp.ranasons[.]com; Darktrace also observed connections to attacker-controlled SimpleHelp servers.
Evidence from security alerts suggested attackers used a vulnerable driver to disable security tools and PDQ Deploy to distribute executables.
Medusa actors have also exploited vulnerabilities in products including GoAnywhere MFT, SimpleHelp, ScreenConnect, Exchange Server and Fortinet Enterprise Management Servers.
The article recommends promptly patching exposed RMM servers and monitoring for anomalous use of remote-management tools.

Article Details

Attack Vectors: Medusa operators obtain access to compromised devices or accounts through initial access brokers, who may use phishing, credential stuffing, or brute-force attacks; they also target vulnerable or misconfigured internet-facing systems.
Reportedly exploited vulnerabilities include CVE-2025-10035 in Fortra GoAnywhere MFT License Servlet; CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 in SimpleHelp; CVE-2024-1709 in ConnectWise ScreenConnect; CVE-2021-34473 in Microsoft Exchange Server; and CVE-2023-48788 in Fortinet Enterprise Management Servers.
The operators abuse remote monitoring and management software, including SimpleHelp, redirecting agents to unauthorized servers they control. Such tools are used for command and control, persistence, lateral movement, downloading tools, exfiltration, and ransomware execution.
In a 2025 incident, attackers used a vulnerable driver to terminate antivirus processes, moved laterally using RDP, NTLM/SMB, DCE_RPC, and PowerShell, and used Robocopy to stage files for exfiltration.
The article reports triple extortion: encrypting data, threatening to leak it, and applying additional pressure through DDoS attacks or contacting victims’ customers.
Defensive Notes: Promptly patch publicly exposed RMM servers.
Use anomaly-based detection to distinguish legitimate administrative activity from malicious RMM use.
Darktrace reports that its Autonomous Response capability blocked malicious activity before file encryption in some observed cases.

Indicators of compromise

Type	Indicator	Context
HOSTNAME	`erp[.]ranasons[.]com`	Data-exfiltration destination used in Medusa-related activity.
HOSTNAME	`pruebas[.]pintacuario[.]mx`	Data-exfiltration destination used in Medusa-related activity; the article says it previously hosted a SimpleHelp server.
IPV4	`143[.]110[.]243[.]154`	IP address associated with the data-exfiltration destination erp.ranasons[.]com.
IPV4	`144[.]217[.]181[.]205`	IP address associated with the data-exfiltration destination pruebas.pintacuario[.]mx.
IPV4	`185[.]108[.]129[.]62`	Malicious SimpleHelp server observed during Medusa attacks.
IPV4	`185[.]126[.]238[.]119`	Malicious SimpleHelp server observed during Medusa attacks.
IPV4	`193[.]37[.]69[.]154`	Suspicious IP observed on a device controlled via SimpleHelp and exfiltrating data to a Medusa-related endpoint.
IPV4	`213[.]183[.]63[.]41`	Malicious SimpleHelp C2 server used in a Medusa compromise.
IPV4	`213[.]183[.]63[.]42`	Malicious SimpleHelp server observed during Medusa attacks.
IPV4	`31[.]220[.]45[.]120`	Malicious SimpleHelp C2 server used in a Medusa compromise.
IPV4	`45[.]9[.]149[.]112`	Malicious SimpleHelp server observed during Medusa attacks.
IPV4	`89[.]36[.]161[.]12`	Malicious SimpleHelp server observed during Medusa attacks.
IPV4	`91[.]92[.]246[.]110`	Malicious SimpleHelp server observed during Medusa attacks.