HOMETHREATSMedusaHTTP
MALWARE FAMILY

MedusaHTTP

Internal ID: win.medusa_http
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Medusa is a DDoS bot written in .NET 2.0. In its current incarnation its C&C protocol is based on HTTP, while its predecessor made use of IRC.

Threat Analysis

MedusaHTTP is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://news.drweb.com/show/?i=10302&lng=en
→https://web.archive.org/web/20200509171721/https://raw.githubusercontent.com/fdiskyou/threat-INTel/master/2015/GlobalThreatIntelReport.pdf
→https://www.arbornetworks.com/blog/asert/medusahttp-ddos-slithers-back-spotlight/
→https://zerophagemalware.com/2017/10/13/rig-ek-via-malvertising-drops-a-miner/

Quick Facts

TypeMalware Family
Aliases1

Also Known As

win.medusa_http

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search MedusaHTTP