Procedure examples

Medusa Group has leveraged Mimikatz to dump LSASS to harvest credentials.

Medusa Group has accessed the ntds.dit file to engage in credential dumping.

Medusa Group has obtained host network details utilizing the command `cmd.exe /c ipconfig /all`.

Medusa Group has used PDQ Inventory to get an inventory of the endpoints on the network.

Medusa Group has used RDP to conduct lateral movement and exfiltrate data. Medusa Group has also utilized the Windows executable `mstsc.exe` for RDP activities through the command `mstsc.exe /v:{hostname/ip}`.

Medusa Group has packed the code of dropped kernel drivers using the packer ASM Guard.

Medusa Group has obfuscated PowerShell scripts with Base64 encoding. Medusa Group has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code.

Medusa Group has utilized PsExec to execute `quser` to discover the user session information.

Medusa Group has the capability to use living off the land (LOTL) binaries to perform network enumeration. Medusa Group has also utilized the publicly available scanning tool SoftPerfect Network Scanner (`netscan.exe`) to discover device hostnames and network services.

Medusa Group has utilized Windows Management Instrumentation to query system information.

Medusa Group has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.

Medusa Group has leveraged PowerShell for execution and defense evasion. Medusa Group has also utilized PowerShell to execute a bitsadmin transfer from file hosting site.

Medusa Group has used Windows Command Prompt to control and execute commands on the system to include ingress, network, and filesystem enumeration activities.

Medusa Group has utilized the `net group` command to query domain groups within the victim environment.

Medusa Group has cleared command history by running the PowerShell command `Remove-Item (Get-PSReadlineOption).HistorySavePath`.

Medusa Group has deleted previously installed tools.

Medusa Group has communicated through reverse or bind shells over port 443 (HTTPS).

Medusa Group has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.

Medusa Group has utilized compromised legitimate local and domain accounts within the victim environment to facilitate remote access and lateral movement sometimes in combination with PsExec.

Medusa Group has leveraged `cmd.exe` to identify system info `cmd.exe /c systeminfo`.

Medusa Group has searched for files within the victim environment for encryption and exfiltration. Medusa Group has also identified files associated with remote management services.

Medusa Group has leveraged `net user` for account discovery.

Medusa Group has used TOR nodes for communications.

Medusa Group has leveraged certutil, PowerShell, and Windows Command to download additional tools to include RMM services. Medusa Group has also engaged in “Bring Your Own Vulnerable Driver” (BYOVD) and downloaded vulnerable or signed drivers to the victim environment to disable security tools.

Medusa Group has leveraged Windows Native API functions to execute payloads.

Medusa Group has modified Registry keys to elevate privileges, maintain persistence and allow remote access.

Medusa Group has identified network shares using `cmd.exe /c net share`.

Medusa Group has created a domain account within the victim environment.

Medusa Group has leveraged public facing vulnerabilities in their campaigns against victim organizations to gain initial access. Medusa Group has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.

Medusa Group has leveraged Microsoft Management Console (MMC) to facilitate lateral movement and to interact locally or remotely with victim devices using the command `mmc.exe compmgmt.msc /computer:{hostname/ip}`.

Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration. Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.

Medusa Group has encrypted files using AES-256 encryption which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”

Medusa Group has terminated services related to backups, security, databases, communication, filesharing and websites.

Medusa Group has deleted recovery files such as shadow copies using `vssadmin.exe`.

Medusa Group has utilized webshells to an exploited Microsoft Exchange Server.

Medusa Group has detected security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.

Medusa Group has manually turned off and encrypted virtual machines.

Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices.

Medusa Group has attempted to bypass UAC using Component Object Model (COM) interface.

Medusa Group has utilized vulnerable or signed drivers to kill or delete services associated with endpoint detection and response (EDR) tools.

Medusa Group has leveraged Component Object Model (COM) to bypass UAC.

Medusa Group has utilized the `ShowWindow` API function to hide the current window.

Medusa Group has utilized Rclone to exfiltrate data from victim environments to cloud storage.

Medusa Group has utilized PsExec to execute scripts and commands within victim environments. Medusa Group has also used the Windows service RoboCopy to search and copy data for exfiltration.

Medusa Group has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.

Medusa Group has used HTTPS for command and control.

Medusa Group has utilized a file hosting service named filemail[.]com to host a zip file that contained malicious payloads that facilitated follow-on actions.

Medusa Group has created social media accounts including Telegram and X to publicize their activities.

Medusa Group has created email accounts used in ransomware negotiations.

Medusa Group has obtained and leveraged numerous RMM services, along with publicly available tools used for scanning. Medusa Group has utilized tools such as Advanced IP Scanner and SoftPerfect Network scanner for user, system and network discovery. Medusa Group has also acquired tools for command and control and defense evasion which include tunneling tools Ligolo and Cloudflared.