S1244: Medusa Ransomware
Medusa Ransomware has been utilized in attacks since at least 2021. Medusa Ransomware has been known to be utilized in conjunction with living off the land techniques and remote management software. Medusa Ransomware has been used in campaigns associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Medusa Ransomware software was initially a closed ransomware variant which later evolved to a Ransomware as a Service (RaaS). Medusa Ransomware has impacted victims from a diverse range of sectors within a multitude of countries, and it is assessed Medusa Ransomware is used in an opportunistic manner.[1][2][3][4]
Security context for executives and security teams
S1244: Medusa Ransomware describes [Medusa Ransomware](https://attack.mitre.org/software/S1244) has been utilized in attacks since at least 2021. [Medusa Ransomware](https://attack.mitre.org/software/S1244) has been known to be utilized in conjunction with living off the land techniques and remote management software. [Medusa Ransomware](https://attack.mitre.org/software/S1244) has been used in campaigns associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to pub...
Executive priority
S1244: Medusa Ransomware is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1244: Medusa Ransomware by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether S1244: Medusa Ransomware appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Medusa Ransomware
Medusa Ransomware has been utilized in attacks since at least 2021. Medusa Ransomware has been known to be utilized in conjunction with living off the land techniques and remote management software. Medusa Ransomware has been used in campaigns associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Medusa Ransomware software was initially a closed ransomware variant which later evolved to a Ransomware as a Service (RaaS). Medusa Ransomware has impacted victims from a diverse range of sectors within a multitude of countries, and it is assessed Medusa Ransomware is used in an opportunistic manner.[1][2][3][4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1135 | Network Share Discovery | Medusa Ransomware has identified networked drives.[3][4][2] |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | Medusa Ransomware has the capability to detect security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.[3] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | Medusa Ransomware has utilized XOR encrypted strings.[3][2] |
| Enterprise | T1679 | Selective Exclusion | Medusa Ransomware has avoided specified files, file extensions and folders to ensure successful execution of the payload and continued operations of the impacted device.[3][4][2] |
| Enterprise | T1007 | System Service Discovery | Medusa Ransomware has leveraged an encoded list of services that it designates for termination.[3][4][2] |
| Enterprise | T1490 | Inhibit System Recovery | Medusa Ransomware has deleted recovery files such as shadow copies using `vssadmin.exe`.[3][1][4][2] |
| Enterprise | T1543.003 | Windows ServiceSub-technique | Medusa Ransomware has created a new PowerShell process using the `CreateProcessA` API.[2] |
| Enterprise | T1057 | Process Discovery | Medusa Ransomware has utilized an encoded list of the processes that it detects and terminates.[3][4][2] |
| Enterprise | T1070.004 | File DeletionSub-technique | Medusa Ransomware has the ability to delete itself after execution.[4] Medusa Ransomware also has the ability to delete itself after execution through the command `cmd /c ping localhost -n 3 > nul & del`.[3][2] |
| Enterprise | T1680 | Local Storage Discovery | Medusa Ransomware has enumerated logical drives on infected hosts.[2] |
| Enterprise | T1489 | Service Stop | Medusa Ransomware has the capability to terminate services related to backups, security, databases, communication, filesharing and websites.[1][4][2] Medusa Ransomware has also utilized the `taskkill /F /IM /T` command to stop targeted processes and `net stop ` command to stop designated services.[4][2] |
| Enterprise | T1106 | Native API | Medusa Ransomware has leveraged Windows Native API functions to execute payloads.[2] |
| Enterprise | T1140 | Deobfuscate/Decode Files or Information | Medusa Ransomware has decoded XOR encrypted strings prior to execution in memory.[3][2] |
| Enterprise | T1564.003 | Hidden WindowSub-technique | Medusa Ransomware has utilized the `ShowWindow` function to hide current window.[2] |
| Enterprise | T1559 | Inter-Process Communication | Medusa Ransomware has leveraged the `CreatePipe` API to enable inter-process communication.[2] |
| Enterprise | T1083 | File and Directory Discovery | Medusa Ransomware has searched for files within the victim environment for encryption and exfiltration.[3][1][2] Medusa Ransomware has also identified files associated with remote management services.[3][1] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | Medusa Ransomware has used `cmd.exe` to execute command on an infected host.[3][2] |
| Enterprise | T1082 | System Information Discovery | Medusa Ransomware has collected data from the SMBIOS firmware table using `GetSystemFirmwareTable`.[2] |
| Enterprise | T1059.001 | PowerShellSub-technique | Medusa Ransomware has launched PowerShell scripts for execution and defense evasion.[3][2] |
| Enterprise | T1124 | System Time Discovery | Medusa Ransomware has discovered device uptime through `GetTickCount()`.[2] |
| Enterprise | T1685 | Disable or Modify Tools | Medusa Ransomware has terminated antivirus services utilizing the gaze.exe executable.[3] Medusa Ransomware has also terminated antivirus services utilizing PowerShell scripts.[3][2] |
| Enterprise | T1486 | Data Encrypted for Impact | Medusa Ransomware has encrypted files using AES-256 encryption, which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”[3][1][4][2] |
Groups, software, and campaigns
G1051: Medusa Group
Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” [1] [2] Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. [3] For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. [4]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.0 | Current bundle | f7d8568f558e… | ||
| 19.1 | 1.0 | Older bundle | f7d8568f558e… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]CISA Medusa Group Medusa Ransomware March 2025
Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.
Open source URL - [2]Security Scorecard Medusa Ransomware January 2024
Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.
Open source URL - [3]Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024
Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.
Open source URL - [4]Broadcom Medusa Ransomware Medusa Group March 2025
Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.
Open source URL - [5]mitre-attackS1244Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.