Home/ Threat Actors/ Medusa Group

🌐Medusa Group

🌐 Medusa Group is a tracked threat actor in the Clankerusecase corpus. ??-aligned. Primary motivation: Criminal. We map 14 detection use cases to this actor across 57 MITRE ATT&CK techniques, with 0 threat-intel articles citing them.

View full actor card → All threat actors MITRE ATT&CK group spec (G1051) ↗

14Use cases

0Articles

57Techniques

0IOCs

About this actor (MITRE)

[Medusa Group](https://attack.mitre.org/groups/G1051) has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” (Citation: CISA Medusa Group Medusa Ransomware March 2025) (Citation: Broadcom Medusa Ransomware Medusa Group March 2025) [Medusa Group](https://attack.mitre.org/groups/G1051) employs living-o

Known aliases

Medusa Group

Top techniques

T1003.001 · LSASS Memory T1003.003 · NTDS T1016 · System Network Configuration Discovery

All other tracked techniques

T1018 · Remote System Discovery T1021.001 · Remote Desktop Protocol T1027.002 · Software Packing T1027.010 · Command Obfuscation T1033 · System Owner/User Discovery T1046 · Network Service Discovery T1047 · Windows Management Instrumentation T1057 · Process Discovery T1059.001 · PowerShell T1059.003 · Windows Command Shell T1069.002 · Domain Groups T1070.003 · Clear Command History T1070.004 · File Deletion T1071.001 · Web Protocols T1072 · Software Deployment Tools T1078 · Valid Accounts T1082 · System Information Discovery T1083 · File and Directory Discovery T1087.001 · Local Account T1090.003 · Multi-hop Proxy T1105 · Ingress Tool Transfer T1106 · Native API T1112 · Modify Registry T1135 · Network Share Discovery T1136.002 · Domain Account T1190 · Exploit Public-Facing Application T1218.014 · MMC T1219 · Remote Access Tools T1486 · Data Encrypted for Impact T1489 · Service Stop T1490 · Inhibit System Recovery T1505.003 · Web Shell T1518.001 · Security Software Discovery T1529 · System Shutdown/Reboot T1543.003 · Windows Service T1548.002 · Bypass User Account Control T1553.002 · Code Signing T1559.001 · Component Object Model T1564.003 · Hidden Window T1567.002 · Exfiltration to Cloud Storage T1569.002 · Service Execution T1570 · Lateral Tool Transfer T1573.002 · Asymmetric Cryptography T1583.006 · Web Services T1585.001 · Social Media Accounts T1585.002 · Email Accounts T1588.002 · Tool T1608.002 · Upload Tool T1650 · Acquire Access T1652 · Device Driver Discovery T1657 · Financial Theft T1685 · Disable or Modify Tools T1686 · Disable or Modify System Firewall T1690 · Prevent Command History Logging

Detection use cases (14)

Medusa Group BYOVD KillAV chain — kernel-driver service install + EDR/AV process termination (gaze.exe / abdullah.exe) AI · profile S Medusa Group rclone / MEGAcmd staged exfiltration to mega.nz before encryption AI · profile SΣ 1Password activity from Tor exit node MITRE match 1Password impossible-travel sign-in MITRE match Brand-Impersonation Domain Fetch Followed by User-Context Loader Within 10 Minutes MITRE match Cross-Platform ClickFix Paste-to-Pipe Loader (UI-Parent Shell with Decode-and-Execute Payload) MITRE match Developer/Data-tooling Daemon Spawns Shell Child Seconds After POST to Runner/Exec Endpoint MITRE match Internet-Facing Service Process Spawning Unix Shell or Ingress-Tool LOLBin (Edge Zero-Day Post-Exploit) MITRE match Internet-facing service process spawns shell/LOLBin within minutes of public inbound connection — post-RCE command execution MITRE match Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress MITRE match Non-Browser Process Reads Browser Credential / Cookie SQLite Then Egresses to Public Destination Within 10 Minutes MITRE match Package Manager / Dev-Tool Auto-Execution Triggers Non-Registry Egress or Credential-Store Access MITRE match Post-Auth Privilege Boundary Crossing on Edge/Management Appliances (low-priv -> admin within 10m) MITRE match Self-hosted application service spawns shell or SSH within seconds of inbound unauthenticated API write MITRE match