Threat Actor Profile
Description
Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” (Citation: CISA Medusa Group Medusa Ransomware March 2025) (Citation: Broadcom Medusa Ransomware Medusa Group March 2025) Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. (Citation: Security Scorecard Medusa Ransomware January 2024) For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. (Citation: Intel471 Medusa Ransomware May 2025)
Confidence Score
Known Aliases
Tags
First Seen
Unknown
Last Updated
Unknown
Active Status
ActiveCreated
April 29, 2026
MITRE ATT&CK Techniques (57)
Indicators of Compromise
Loading IOCs…
IOC KQL for Sentinel
STIX Data
{'aliases': ['Medusa Group'],
'created': '2025-10-15T18:54:55.000Z',
'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'description': '[Medusa Group](https://attack.mitre.org/groups/G1051) has '
'been active since at least 2021 and was initially operated as '
'a closed ransomware group before evolving into a '
'Ransomware-as-a-Service (RaaS) operation. Some reporting '
'indicates that certain attacks may still be conducted '
'directly by the ransomware’s core developers. Public sources '
'have also referred to the group as “Spearwing” or “Medusa '
'Actors.” (Citation: CISA Medusa Group Medusa Ransomware March '
'2025) (Citation: Broadcom Medusa Ransomware Medusa Group '
'March 2025) [Medusa '
'Group](https://attack.mitre.org/groups/G1051) employs '
'living-off-the-land techniques, frequently leveraging '
'publicly available tools and common remote management '
'software to conduct operations. The group engages in double '
'extortion tactics, exfiltrating data prior to encryption and '
'threatening to publish stolen information if ransom demands '
'are not met. (Citation: Security Scorecard Medusa Ransomware '
'January 2024) For initial access, [Medusa '
'Group](https://attack.mitre.org/groups/G1051) has exploited '
'publicly known vulnerabilities, conducted phishing campaigns, '
'and used credentials or access purchased from Initial Access '
'Brokers (IABs). The group is opportunistic and has targeted a '
'wide range of sectors globally. (Citation: Intel471 Medusa '
'Ransomware May 2025)',
'external_references': [{'external_id': 'G1051',
'source_name': 'mitre-attack',
'url': 'https://attack.mitre.org/groups/G1051'},
{'description': 'Cybersecurity and Infrastructure '
'Security Agency. (2025, March 12). '
'AA25-071A #StopRansomware: Medusa '
'Ransomware. Retrieved October 15, '
'2025.',
'source_name': 'CISA Medusa Group Medusa Ransomware '
'March 2025',
'url': 'https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a'},
{'description': 'Intel471. (2025, May 14). Threat '
'hunting case study: Medusa '
'ransomware. Retrieved October 15, '
'2025.',
'source_name': 'Intel471 Medusa Ransomware May 2025',
'url': 'https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware'},
{'description': 'Threat Hunter Team Symantec and '
'Carbon Black. (2025, March 6). '
'Medusa Ransomware Activity Continues '
'to Increase. Retrieved October 15, '
'2025.',
'source_name': 'Broadcom Medusa Ransomware Medusa '
'Group March 2025',
'url': 'https://www.security.com/threat-intelligence/medusa-ransomware-attacks'},
{'description': 'Vlad Pasca. (2024, January 1). A '
'Deep Dive into Medusa Ransomware. '
'Retrieved October 15, 2025.',
'source_name': 'Security Scorecard Medusa Ransomware '
'January 2024',
'url': 'https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf'}],
'id': 'intrusion-set--918da025-04bd-48af-b6c4-f3e4d1b915eb',
'modified': '2025-10-24T04:01:48.210Z',
'name': 'Medusa Group',
'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
'revoked': False,
'spec_version': '2.1',
'type': 'intrusion-set',
'x_mitre_attack_spec_version': '3.3.0',
'x_mitre_deprecated': False,
'x_mitre_domains': ['enterprise-attack'],
'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
'x_mitre_version': '1.0'}