CVE Intelligence
Home / Threat actors / Medusa Group

Medusa Group G1051

🔔 Create alert

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

2
associated CVEs
63
Techniques
5
Malware and tools

Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally.

Ransomware operations linked to this group ransomware.live

medusa

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2024-1709 Critical · 10.0 KEV Ransomware ConnectWise ScreenConnect Authentication Bypass Vulnerability
“Medusa Group has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.”
CVE-2023-48788 Critical · 9.8 KEV Ransomware Fortinet FortiClient EMS SQL Injection Vulnerability
“Medusa Group has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.”

Techniques by tactic

Resource Development
T1583.006 Web ServicesT1585.001 Social Media AccountsT1585.002 Email AccountsT1588.002 ToolT1608.002 Upload ToolT1650 Acquire Access
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing Application
Execution
T1047 Windows Management InstrumentationT1059.001 PowerShellT1059.003 Windows Command ShellT1072 Software Deployment ToolsT1106 Native APIT1559.001 Component Object ModelT1569.002 Service Execution
Persistence
T1078 Valid AccountsT1112 Modify RegistryT1136.002 Domain AccountT1505.003 Web ShellT1543.003 Windows Service
Privilege Escalation
T1078 Valid AccountsT1543.003 Windows ServiceT1548.002 Bypass User Account Control
Stealth
T1027.002 Software PackingT1027.010 Command ObfuscationT1070.003 Clear Command HistoryT1070.004 File DeletionT1078 Valid AccountsT1218.014 MMCT1564.003 Hidden Window
Defense Impairment
T1112 Modify RegistryT1553.002 Code SigningT1685 Disable or Modify ToolsT1686 Disable or Modify System FirewallT1690 Prevent Command History Logging
Credential Access
T1003.001 LSASS MemoryT1003.003 NTDS
Discovery
T1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1033 System Owner/User DiscoveryT1046 Network Service DiscoveryT1057 Process DiscoveryT1069.002 Domain GroupsT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087.001 Local AccountT1135 Network Share DiscoveryT1518.001 Security Software DiscoveryT1652 Device Driver Discovery
Lateral Movement
T1021.001 Remote Desktop ProtocolT1072 Software Deployment ToolsT1570 Lateral Tool Transfer
Command and Control
T1071.001 Web ProtocolsT1090.003 Multi-hop ProxyT1105 Ingress Tool TransferT1219 Remote Access ToolsT1573.002 Asymmetric Cryptography
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Impact
T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System RecoveryT1529 System Shutdown/RebootT1657 Financial Theft

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.