Medusa Ransomware Unleashes Havoc Using Stolen Certificates to Evade Detection

At a glance

• Medusa ransomware attackers are using a malicious driver signed with stolen certificates.
• The driver is used to disable security software before the ransomware runs.
• Elastic Security Labs published the analysis in March 2025.
• Medusa has hit hundreds of victims, including critical infrastructure.
• Defenders are urged to watch for the driver and block vulnerable or revoked drivers.

A driver that switches off defenses

Medusa ransomware operators have added a new tool. In March 2025, Elastic Security Labs described a malicious Windows driver it calls ABYSSWORKER, which Medusa attacks use to switch off endpoint security products before encrypting files. The driver is signed with certificates that were likely stolen.

How ABYSSWORKER works

The driver, usually named smuol.sys, poses as a legitimate CrowdStrike Falcon driver. Elastic found it signed with likely stolen and revoked certificates from Chinese companies. That signature helps it load on Windows systems. Once running in the kernel, it can terminate, blind or permanently disable endpoint detection and antivirus tools, which leaves the ransomware free to run.

Who Medusa targets

Elastic’s analysis covered samples from August 2024 to February 2025. A joint advisory from the FBI, CISA and MS-ISAC that same month said Medusa had hit more than 300 victims, including healthcare providers, schools, government agencies and other critical infrastructure. Organizations that cannot tolerate downtime are attractive targets.

How defenders are responding

Security researchers have published detection rules and indicators for the driver. Elastic released YARA rules, and the joint advisory lists Medusa’s tactics and indicators of compromise.

Ransomware and critical infrastructure

Ransomware gangs once went after individual machines. Now they go after whole organizations, including ones that provide essential services, because downtime there creates pressure to pay. When attackers disable security tools first, the damage spreads faster.

How to defend against it

Defenders should treat any new kernel driver as suspicious, especially one installed from a user-writable path or signed by an unexpected vendor. Microsoft’s vulnerable driver blocklist helps, along with keeping systems patched and training staff to spot phishing.

Hunting for ABYSSWORKER

Medusa’s use of a signed driver shows how far ransomware groups will go to get past defenses. Security teams should search for smuol.sys and for any driver claiming to be CrowdStrike’s that is not in the expected location, alert when security agents stop unexpectedly, and review the indicators in the CISA advisory.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.