Medusa Group

Overview

Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally.

Naming & attribution

Medusa Group is tracked under 1 names across the industry. It uses 57 documented ATT&CK techniques — more than 88% of the 174 groups tracked here. Activity attributed since at least 2021.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1218.014 MMC — used by 1 of 174 groups
• T1650 Acquire Access — used by 1 of 174 groups
• T1652 Device Driver Discovery — used by 1 of 174 groups
• T1608.002 Upload Tool — used by 2 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• BlackByte — 26 shared techniques (33% overlap)
• Wizard Spider Russia — 29 shared techniques (32% overlap)
• APT38 North Korea — 24 shared techniques (27% overlap)
• APT41 China — 29 shared techniques (26% overlap)
• Magic Hound Iran — 28 shared techniques (26% overlap)
• INC Ransom — 17 shared techniques (26% overlap)

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 57 techniques across 13 tactics

Tools & malware (5)

certutil · Rclone · Medusa Ransomware · Mimikatz · PsExec

Reporting (3)

• Threat hunting case study: Medusa ransomware — Intel471
• AA25-071A #StopRansomware: Medusa Ransomware — Cybersecurity and Infrastructure Security Agency
• Medusa Ransomware Activity Continues to Increase — Threat Hunter Team Symantec and Carbon Black