Threat actor · G1051

Medusa Group

UnattributedNo public state or group attribution on record

Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.

MITRE ATT&CK Techniques

Associated Malware

Medusa RansomwareMimikatzPsExecRclonecertutil

Full MITRE ATT&CK profile

0 recent articles mention this actor

No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.