MITRE ATT&CKsoftware (malware)

S1220 MEDUSA

Published 2025-06-09 Modified 2025-06-09 Official page ↗

Domain: enterprise
Platforms: Linux
Version: 1.0
Created: 2025-06-09

Description

MEDUSA is an open-source rootkit that is capable of dynamic linker hijacking, command execution, and logging credentials.

Related

Uses · MITRE ATT&CK (4)

T1027.013 Encrypted/Encoded File sub-technique
T1574.006 Dynamic Linker Hijacking sub-technique
T1563.001 SSH Hijacking sub-technique
T1014 Rootkit technique

Referenced by MITRE ATT&CK · uses (2)

C0056 RedPenguin campaign
G1048 UNC3886 group

References

https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations Google Cloud Mandiant UNC3886 2024