Home / Ransomware Intelligence / All groups / medusa

medusa Ransomware

🔔 Create alert

Tracked since Jan 11, 2023

0

victims recorded

0

in the last 30 days

2

CVEs

—

Last activity

In MITRE ATT&CK MITRE ATT&CK

Group profile: Medusa Group (G1051)

Ransomware cataloged as MEDUSA (S1220)

Used by: UNC3886 G1048

Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.

Vulnerabilities cited for this group

CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.

CVE-2024-1709 Critical · 10.0 KEV ConnectWise ScreenConnect Authentication Bypass Vulnerability
CVE-2023-48788 Critical · 9.8 KEV Fortinet FortiClient EMS SQL Injection Vulnerability

Tactics and techniques (MITRE ATT&CK)

Initial Access

T1078 Valid Accounts T1133 External Remote Services T1190 Exploit Public-Facing Application T1566 Phishing

Execution

T1047 Windows Management Instrumentation T1059 Command and Scripting Interpreter T1059.001 Command and Scripting Interpreter: PowerShell T1059.003 Command and Scripting Interpreter: Windows Command Shell T1072 Software Deployment Tools T1106 Native API T1559.001 Inter-Process Communication: Component Object Model T1569.002 System Services: Service Execution T1675 ESXi Administration Command

Persistence

T1112 Modify Registry T1136.002 Create Account: Domain Account T1505.003 Server Software Component: Web Shell T1543.003 Create or Modify System Process: Windows Service

Privilege Escalation

T1484.001 Domain or Tenant Policy Modification: Group Policy Modification T1543.003 Create or Modify System Process: Windows Service T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Stealth

T1006 Direct Volume Access T1027 Obfuscated Files or Information T1027.002 Obfuscated Files or Information: Software Packing T1027.010 Obfuscated Files or Information: Command Obfuscation T1027.013 Obfuscated Files or Information: Encrypted/Encoded File T1070 Indicator Removal T1070.003 Indicator Removal: Clear Command History T1070.004 Indicator Removal: File Deletion T1218.014 System Binary Proxy Execution: MMC T1564.003 Hide Artifacts: Hidden Window T1564.012 Hide Artifacts: File/Path Exclusions

Defense Evasion

T1562 Impair Defenses T1562.001 Disable or Modify Tools T1562.009 Safe Mode Boot

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory T1003.003 OS Credential Dumping: NTDS T1110 Brute Force T1558 Steal or Forge Kerberos Tickets

Discovery

T1016 System Network Configuration Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1046 Network Service Discovery T1049 System Network Connections Discovery T1057 Process Discovery T1069.002 Permission Groups Discovery: Domain Groups T1082 System Information Discovery T1083 File and Directory Discovery T1087.001 Account Discovery: Local Account T1135 Network Share Discovery T1518.001 Software Discovery: Security Software Discovery T1652 Device Driver Discovery

Lateral Movement

T1021 Remote Services T1021.001 Remote Services: Remote Desktop Protocol T1072 Software Deployment Tools T1570 Lateral Tool Transfer

Exfiltration

T1045 Exfiltration Over C2 Channel T1048 Exfiltration Over Alternative Protocol T1567 Exfiltration Over Web Service T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage

Command and Control

T1071.001 Application Layer Protocol: Web Protocols T1090.003 Proxy: Multi-hop Proxy T1105 Ingress Tool Transfer T1219 Remote Access Tools T1573.002 Encrypted Channel: Asymmetric Cryptography

Impact

T1486 Data Encrypted for Impact T1489 Service Stop T1490 Inhibit System Recovery T1529 System Shutdown/Reboot T1657 Financial Theft

Resource Development

T1583.006 Acquire Infrastructure: Web Services T1585.001 Establish Accounts: Social Media Accounts T1585.002 Establish Accounts: Email Accounts T1588.002 Obtain Capabilities: Tool T1608.002 Stage Capabilities: Upload Tool T1650 Acquire Access

Defense Impairment

T1112 Modify Registry T1553.002 Subvert Trust Controls: Code Signing T1685 Disable or Modify Tools T1686 Disable or Modify System Firewall T1690 Prevent Command History Logging

Observed tools

Credential Theft

Mimikatz

Defense Evasion

EDRSandBlast · KillAV · ThrottleStop driver

Discovery Enum

Advanced IP Scanner · Navicat · PDQ Inventory · RoboCopy · SoftPerfect NetScan

Exfiltration

RClone

LOLBAS

BITSAdmin · Process Explorer · PsExec

Networking

Cloudflared · FRP · Ligolo · PuTTY · RevSocks

RMM-Tools

AnyDesk · Atera · HCL BigFix · N-Able · PDQ Deploy · ScreenConnect · SimpleHelp · Splashtop · eHorus

Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live