Medusa Ransomware C2 Communication

nomit vyas@xoxo

•updated Jun 23, 2026•1•0•5

This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.