Threat group.View on attack.mitre.org
Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally.
| Technique | Procedure example |
|---|---|
| T1003.001 LSASS Memory |
Medusa Group has leveraged Mimikatz to dump LSASS to harvest credentials. |
| T1003.003 NTDS |
Medusa Group has accessed the ntds.dit file to engage in credential dumping. |
| T1016 System Network Configuration Discovery |
Medusa Group has obtained host network details utilizing the command `cmd.exe /c ipconfig /all`. |
| T1018 Remote System Discovery |
Medusa Group has used PDQ Inventory to get an inventory of the endpoints on the network. |
| T1021.001 Remote Desktop Protocol |
Medusa Group has used RDP to conduct lateral movement and exfiltrate data. Medusa Group has also utilized the Windows executable `mstsc.exe` for RDP activities through the command `mstsc.exe /v:{hostname/ip}`. |
| T1027.002 Software Packing |
Medusa Group has packed the code of dropped kernel drivers using the packer ASM Guard. |
| T1027.010 Command Obfuscation |
Medusa Group has obfuscated PowerShell scripts with Base64 encoding. Medusa Group has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code. |
| T1033 System Owner/User Discovery |
Medusa Group has utilized PsExec to execute `quser` to discover the user session information. |
| T1046 Network Service Discovery |
Medusa Group has the capability to use living off the land (LOTL) binaries to perform network enumeration. Medusa Group has also utilized the publicly available scanning tool SoftPerfect Network Scanner (`netscan.exe`) to discover device hostnames and network services. |
| T1047 Windows Management Instrumentation |
Medusa Group has utilized Windows Management Instrumentation to query system information. |
| T1057 Process Discovery |
Medusa Group has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094. |
| T1059.001 PowerShell |
Medusa Group has leveraged PowerShell for execution and defense evasion. Medusa Group has also utilized PowerShell to execute a bitsadmin transfer from file hosting site. |
| T1059.003 Windows Command Shell |
Medusa Group has used Windows Command Prompt to control and execute commands on the system to include ingress, network, and filesystem enumeration activities. |
| T1069.002 Domain Groups |
Medusa Group has utilized the `net group` command to query domain groups within the victim environment. |
| T1070.003 Clear Command History |
Medusa Group has cleared command history by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
