MITRE ATT&CKgroup
G1051 Medusa Group
- Domain
- enterprise
- Version
- 1.0
- Created
- 2025-10-15
Description
Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally.
Related
Uses · MITRE ATT&CK (62)
- T1685 Disable or Modify Tools technique
- T1686 Disable or Modify System Firewall technique
- T1690 Prevent Command History Logging technique
- S1244 Medusa Ransomware software (malware)
- T1657 Financial Theft technique
- T1652 Device Driver Discovery technique
- T1027.010 Command Obfuscation sub-technique
- T1650 Acquire Access technique
- S1040 Rclone software (tool)
- T1218.014 MMC sub-technique
- T1608.002 Upload Tool sub-technique
- T1583.006 Web Services sub-technique
- T1585.001 Social Media Accounts sub-technique
- T1585.002 Email Accounts sub-technique
- T1588.002 Tool sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1564.003 Hidden Window sub-technique
- T1570 Lateral Tool Transfer technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1069.002 Domain Groups sub-technique
- T1087.001 Local Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1559.001 Component Object Model sub-technique
- T1003.001 LSASS Memory sub-technique
- T1003.003 NTDS sub-technique
References
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a CISA Medusa Group Medusa Ransomware March 2025
- https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware Intel471 Medusa Ransomware May 2025
- https://www.security.com/threat-intelligence/medusa-ransomware-attacks Broadcom Medusa Ransomware Medusa Group March 2025
- https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf Security Scorecard Medusa Ransomware January 2024