Overview
Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.
- First tracked: 2023-01-11
- Discussed in our reports: UAE
What public reporting says
Also known as: Spearwing · Storm-1175 (Microsoft’s name for one affiliate)
- Attribution conflicts. Microsoft attributes the Storm-1175 affiliate to a China-based financially motivated group, while Cyrillic scripts, Russian-forum activity and CIS exclusions suggest a Russian-speaking core. We therefore map no origin country.
- In 2026 Microsoft linked the Storm-1175 affiliate to zero-day exploitation of Fortra GoAnywhere MFT (CVE-2025-10035) and SmarterTools SmarterMail (CVE-2026-23760) about a week before public disclosure.
BleepingComputer · Cloud Security Alliance
Geography: origin and targets
No public attribution of origin. Lines are drawn only where public reporting places the operators; flags show where the group has claimed victims, sized by number of claims.
United States of America262
United Kingdom38
Canada35
Italy14
Australia14
Brazil10
France10
India8
Germany6
Norway6
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| Fortinet | FortiClientEMS | CVE-2023-48788 | Network edge | cisa.gov, cisa.gov |
| ConnectWise | ScreenConnect | CVE-2024-1708 | Remote management tools | cisa.gov, unit42.paloaltonetworks.com, trendmicro.com, bleepingcomputer.com, cisa.gov |
| ConnectWise | ScreenConnect | CVE-2024-1709 | Remote management tools | cisa.gov, unit42.paloaltonetworks.com, trendmicro.com, bleepingcomputer.com, cisa.gov |
| SimpleHelp | SimpleHelp RMM | CVE-2024-57727 | Remote management tools | cisa.gov, sophos.com, CuratedIntel, s-rminform.com |
| SimpleHelp | SimpleHelp RMM | CVE-2024-57728 | Remote management tools | cisa.gov, sophos.com, CuratedIntel, s-rminform.com |
| Citrix | NetScaler ADC & Gateway | CVE-2023-4966 | Virtualization | doublepulsar.com, bleepingcomputer.com, therecord.media, secureworks.com, microsoft.com |
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Initial Access (TA0001)
- T1078 · Valid Accounts: Initial access through brute force or compromised credentials of legitimate RDP accounts.
- T1133 · External Remote Services: Accesses the victim's network via an RDP service.
- T1190 · Exploit Public-Facing Application: Medusa Group has leveraged public facing vulnerabilities in their campaigns against victim organizations to gain initial access. Medusa Group has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.
- T1566 · Phishing: Initial access through phishing email attachments.
Execution (TA0002)
- T1047 · Windows Management Instrumentation: Uses a series of Windows commands, such as bcdedit.exe and vssadmin.
- T1059 · Command and Scripting Interpreter: Uses a series of Windows commands, such as bcdedit.exe and vssadmin.
- T1059.001 · Command and Scripting Interpreter: PowerShell: Medusa Group has leveraged PowerShell for execution and defense evasion. Medusa Group has also utilized PowerShell to execute a bitsadmin transfer from file hosting site.
- T1059.003 · Command and Scripting Interpreter: Windows Command Shell: Medusa Group has used Windows Command Prompt to control and execute commands on the system to include ingress, network, and filesystem enumeration activities.
- T1072 · Software Deployment Tools: Medusa Group has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.
- T1106 · Native API: Medusa Group has leveraged Windows Native API functions to execute payloads.
- T1559.001 · Inter-Process Communication: Component Object Model: Medusa Group has leveraged Component Object Model (COM) to bypass UAC.
- T1569.002 · System Services: Service Execution: Medusa Group has utilized PsExec to execute scripts and commands within victim environments. Medusa Group has also used the Windows service RoboCopy to search and copy data for exfiltration.
- T1675 · ESXi Administration Command: Medusa actors abuse ESXi administration services to force root passwords to Medusa-controlled passwords on Linux machines.
Persistence (TA0003)
- T1112 · Modify Registry: Medusa Group has modified Registry keys to elevate privileges, maintain persistence and allow remote access.
- T1136.002 · Create Account: Domain Account: Medusa Group has created a domain account within the victim environment.
- T1505.003 · Server Software Component: Web Shell: Medusa Group has utilized webshells to an exploited Microsoft Exchange Server.
- T1543.003 · Create or Modify System Process: Windows Service: Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices.
Privilege Escalation (TA0004)
- T1484.001 · Domain or Tenant Policy Modification: Group Policy Modification: Medusa actors made changes to Active Directory Default Domain Policy settings to override Group Policy settings.
- T1543.003 · Create or Modify System Process: Windows Service: Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices.
- T1548.002 · Abuse Elevation Control Mechanism: Bypass User Account Control: Medusa Group has attempted to bypass UAC using Component Object Model (COM) interface.
Stealth (TA0005)
- T1006 · Direct Volume Access: Medusa actors use vssadmin to bypass Windows file access controls and file system monitoring tools to obtain copies of registry hives.
- T1027 · Obfuscated Files or Information: Medusa actors obfuscate a string by slicing it into pieces and referencing it via a variable.
- T1027.002 · Obfuscated Files or Information: Software Packing: Medusa Group has packed the code of dropped kernel drivers using the packer ASM Guard.
- T1027.010 · Obfuscated Files or Information: Command Obfuscation: Medusa Group has obfuscated PowerShell scripts with Base64 encoding. Medusa Group has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code.
- T1027.013 · Obfuscated Files or Information: Encrypted/Encoded File: Medusa actors use a well-known stealth technique that executes a base64 encrypted command.
- T1070 · Indicator Removal: Medusa actors delete their previous work and tools installed.
- T1070.003 · Indicator Removal: Clear Command History: Medusa Group has cleared command history by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.
- T1070.004 · Indicator Removal: File Deletion: Medusa Group has deleted previously installed tools.
- T1218.014 · System Binary Proxy Execution: MMC: Medusa Group has leveraged Microsoft Management Console (MMC) to facilitate lateral movement and to interact locally or remotely with victim devices using the command `mmc.exe compmgmt.msc /computer:{hostname/ip}`.
- T1564.003 · Hide Artifacts: Hidden Window: Medusa Group has utilized the `ShowWindow` API function to hide the current window.
- T1564.012 · Hide Artifacts: File/Path Exclusions: Medusa actors operate in pre-existing excluded folders within Windows Defender.
Defense Evasion (TA0005)
- T1562 · Impair Defenses: Employs Windows Management Instrumentation (WMIC) command-line to delete shadow copies.
- T1562.001 · Disable or Modify Tools: Terminates services or processes related to antivirus/security tools.
- T1562.009 · Safe Mode Boot: Abuses Safe Mode to evade endpoint detection.
Credential Access (TA0006)
- T1003.001 · OS Credential Dumping: LSASS Memory: Medusa Group has leveraged Mimikatz to dump LSASS to harvest credentials.
- T1003.003 · OS Credential Dumping: NTDS: Medusa Group has accessed the ntds.dit file to engage in credential dumping.
- T1110 · Brute Force: Uses brute force on local RDP account passwords.
- T1558 · Steal or Forge Kerberos Tickets: Medusa actors steal credentials by copying Windows database files and using them to create forged Kerberos tickets.
Discovery (TA0007)
- T1016 · System Network Configuration Discovery: Medusa Group has obtained host network details utilizing the command `cmd.exe /c ipconfig /all`.
- T1018 · Remote System Discovery: Medusa Group has used PDQ Inventory to get an inventory of the endpoints on the network.
- T1033 · System Owner/User Discovery: Medusa Group has utilized PsExec to execute `quser` to discover the user session information.
- T1046 · Network Service Discovery: Medusa Group has the capability to use living off the land (LOTL) binaries to perform network enumeration. Medusa Group has also utilized the publicly available scanning tool SoftPerfect Network Scanner (`netscan.exe`) to discover device hostnames and network services.
- T1049 · System Network Connections Discovery: Medusa actors use the command netstat -a to gather a listing of network connections.
- T1057 · Process Discovery: Medusa Group has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.
- T1069.002 · Permission Groups Discovery: Domain Groups: Medusa Group has utilized the `net group` command to query domain groups within the victim environment.
- T1082 · System Information Discovery: Medusa Group has leveraged `cmd.exe` to identify system info `cmd.exe /c systeminfo`.
- T1083 · File and Directory Discovery: Queries specified files, folders, and file extensions.
- T1087.001 · Account Discovery: Local Account: Medusa Group has leveraged `net user` for account discovery.
- T1135 · Network Share Discovery: Enumerates network shares.
- T1518.001 · Software Discovery: Security Software Discovery: Medusa Group has detected security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.
- T1652 · Device Driver Discovery: Medusa Group has queried drivers on the victim device through the command `driverquery`.
Lateral Movement (TA0008)
- T1021 · Remote Services: Uses remote services for login and lateral movement via RDP and SMB.
- T1021.001 · Remote Services: Remote Desktop Protocol: Medusa Group has used RDP to conduct lateral movement and exfiltrate data. Medusa Group has also utilized the Windows executable `mstsc.exe` for RDP activities through the command `mstsc.exe /v:{hostname/ip}`.
- T1072 · Software Deployment Tools: Medusa Group has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.
- T1570 · Lateral Tool Transfer: Medusa Group has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.
Exfiltration (TA0010)
- T1045 · Exfiltration Over C2 Channel: Transfers data to attacker-controlled servers via an existing command-and-control (C2) channel.
- T1048 · Exfiltration Over Alternative Protocol: Exfiltrates data using alternative protocols, such as FTP/SFTP, to avoid detection by traditional methods.
- T1567 · Exfiltration Over Web Service: Exfiltrates data using web services like cloud services (e.g., Google Drive, Dropbox, etc.).
- T1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud Storage: Medusa Group has utilized Rclone to exfiltrate data from victim environments to cloud storage.
Command and Control (TA0011)
- T1071.001 · Application Layer Protocol: Web Protocols: Medusa Group has communicated through reverse or bind shells over port 443 (HTTPS).
- T1090.003 · Proxy: Multi-hop Proxy: Medusa Group has used TOR nodes for communications.
- T1105 · Ingress Tool Transfer: Uses certutil to download malicious files.
- T1219 · Remote Access Tools: Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration. Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.
- T1573.002 · Encrypted Channel: Asymmetric Cryptography: Medusa Group has used HTTPS for command and control.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: Uses the AES-256 algorithm to encrypt files on the computer.
- T1489 · Service Stop: Terminates processes and services related to database servers, email servers, and backups.
- T1490 · Inhibit System Recovery: Deletes shadow copies and disables the Windows System Restore feature.
- T1529 · System Shutdown/Reboot: Medusa Group has manually turned off and encrypted virtual machines.
- T1657 · Financial Theft: Medusa Group has stolen and encrypted victims' data in order to extort victims into paying a ransom.
Resource Development (TA0042)
- T1583.006 · Acquire Infrastructure: Web Services: Medusa Group has utilized a file hosting service named filemail[.]com to host a zip file that contained malicious payloads that facilitated follow-on actions.
- T1585.001 · Establish Accounts: Social Media Accounts: Medusa Group has created social media accounts including Telegram and X to publicize their activities.
- T1585.002 · Establish Accounts: Email Accounts: Medusa Group has created email accounts used in ransomware negotiations.
- T1588.002 · Obtain Capabilities: Tool: Medusa Group has obtained and leveraged numerous RMM services, along with publicly available tools used for scanning. Medusa Group has utilized tools such as Advanced IP Scanner and SoftPerfect Network scanner for user, system and network discovery. Medusa Group has also acquired tools for command and control and defense evasion which include tunneling tools Ligolo and Cloudflared.
- T1608.002 · Stage Capabilities: Upload Tool: Medusa Group has utilized a file hosting service called filemail[.]com to host a zip file that contained a RMM service such as ConnectWise.
- T1650 · Acquire Access: Medusa Group has purchased user credentials and other sensitive data from Initial Access Brokers (IABs).
Defense Impairment (TA0112)
- T1112 · Modify Registry: Medusa Group has modified Registry keys to elevate privileges, maintain persistence and allow remote access.
- T1553.002 · Subvert Trust Controls: Code Signing: Medusa Group has utilized vulnerable or signed drivers to kill or delete services associated with endpoint detection and response (EDR) tools.
- T1685 · Disable or Modify Tools: Medusa Group has terminated antivirus services utilizing the gaze.exe executable and utilizing `psexec.exe`. Medusa Group has also leveraged I/O control codes (IOCTLs) for terminating and deleting processes of identified security tools.
- T1686 · Disable or Modify System Firewall: Medusa Group has utilized PsExec to execute batch scripts that modify firewall settings. Medusa Group has also enabled and modified firewall rules to allow for RDP connections for lateral movement and device interactions.
- T1690 · Prevent Command History Logging: Medusa Group has removed PowerShell command history through the use of the PSReadLine module by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.
Tools
Credential theft
- Mimikatz
Defense evasion
- EDRSandBlast
- KillAV
- ThrottleStop driver
Discovery
- Advanced IP Scanner
- Navicat
- PDQ Inventory
- RoboCopy
- SoftPerfect NetScan
Exfiltration
- RClone
Living off the land
- BITSAdmin
- Process Explorer
- PsExec
Networking and tunnelling
- Cloudflared
- FRP
- Ligolo
- PuTTY
- RevSocks
Remote management tools
- AnyDesk
- Atera
- HCL BigFix
- N-Able
- PDQ Deploy
- ScreenConnect
- SimpleHelp
- Splashtop
- eHorus
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| Human Verify | DLS | kyfiw76eol6ph2mq7pi5e5tdvce37bicddhai62qhdc5ja6jdchz4qqd[.]onion | No |
| Human Verify | DLS | s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad[.]onion | No |
| — | DLS | 62foekhv5humjrfwjdyd2dgextpbf5i7obguhwvfoghmu3nxpkmxlcid[.]onion | No |
| Medusa Chat | Chat | medusakxxtp3uo7vusntvubnytaph4d3amxivbggl3hnhpk2nmus34yd[.]onion | No |
| 503 Service Temporarily Unavailable | DLS | dlmfciajg5s4vliyo5dhs5jyzhi2xr2fnkebul46lpf4xudtqiue4nid[.]onion | No |
| Human Verify | DLS | cx5u7zxbvrfyoj6ughw76oa264ucuuizmmzypwum6ear7pct4yc723qd[.]onion | No |
| Human Verify | DLS | xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd[.]onion | No |
| — | DLS | 45[.]9[.]148[.]39 | No |
| — | DLS | hupxs7ps7md24kpz4lwsbra64abgxjx3pcc2wuca5ibawf2g5hlpfyqd[.]onion | No |
| Human Verify | DLS | medusaxko7jxtrojdkxo66j7ck4q5tgktf7uqsqyfry4ebnxlcbkccyd[.]onion | No |
| — | DLS | 7aqabivkwmpvjkyefonf3gpy5gsubopqni7kcirsrq3pflckxq5zz4id[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11