Medusa Ransomware C2 Communication

nomit vyas@xoxo

•updated Jun 22, 2026•1•0•2

This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.