Medusa Group

Overview

Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally.

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 57 techniques across 13 tactics

Tools & malware (5)

certutil · Rclone · Medusa Ransomware · Mimikatz · PsExec

Reporting (3)

• Threat hunting case study: Medusa ransomware — Intel471
• AA25-071A #StopRansomware: Medusa Ransomware — Cybersecurity and Infrastructure Security Agency
• Medusa Ransomware Activity Continues to Increase — Threat Hunter Team Symantec and Carbon Black