Storm-1175 - Medusa Note Generation (T1486)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•4

Detects the widespread creation of the specific !readme_medusa!.txt ransom note or its HTML variant across directories, indicating a Medusa ransomware operation.