Medusa Group
Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and…
- ATT&CK ID
- G1051
- Techniques
- 52
- Tools
- 5
Vulnerabilities it has exploited
- CVE-2023-48788 Fortinet FortiClient EMSUnscored · exploited in the wild
- CVE-2024-1709 ConnectWise ScreenConnectUnscored · exploited in the wild
Techniques
Resource Development
Acquire InfrastructureEstablish AccountsObtain CapabilitiesStage CapabilitiesAcquire Access
Initial Access
Valid AccountsExploit Public-Facing Application
Execution
Windows Management InstrumentationCommand and Scripting InterpreterSoftware Deployment ToolsNative APIInter-Process CommunicationSystem Services
Persistence
Valid AccountsModify RegistryCreate AccountServer Software ComponentCreate or Modify System Process
Privilege Escalation
Valid AccountsCreate or Modify System ProcessAbuse Elevation Control Mechanism
Stealth
Obfuscated Files or InformationIndicator RemovalValid AccountsSystem Binary Proxy ExecutionHide Artifacts
Defense Impairment
Modify RegistrySubvert Trust ControlsDisable or Modify ToolsDisable or Modify System FirewallPrevent Command History Logging
Credential Access
Discovery
System Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoveryNetwork Service DiscoveryProcess DiscoveryPermission Groups DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount DiscoveryNetwork Share DiscoverySoftware DiscoveryDevice Driver Discovery
Lateral Movement
Remote ServicesSoftware Deployment ToolsLateral Tool Transfer
Command and Control
Application Layer ProtocolProxyIngress Tool TransferRemote Access ToolsEncrypted Channel
Exfiltration
Impact
Data Encrypted for ImpactService StopInhibit System RecoverySystem Shutdown/RebootFinancial Theft
Software
Medusa Ransomware · Mimikatz · PsExec · Rclone · certutil