LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1244: Medusa Ransomware

Medusa Ransomware has been utilized in attacks since at least 2021. Medusa Ransomware has been known to be utilized in conjunction with living off the land techniques and remote management software. Medusa Ransomware has been used in campaigns associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Medusa Ransomware software was initially a closed ransomware variant which later evolved to a Ransomware as a Service (RaaS). Medusa Ransomware has impacted victims from a diverse range of sectors within a multitude of countries, and it is assessed Medusa Ransomware is used in an opportunistic manner.[1][2][3][4]

EnterpriseS1244MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Medusa Ransomware matters because the ATT&CK entry ties it to opportunistic, double-extortion ransomware activity: data may be taken before encryption, increasing both outage and disclosure risk. For leaders, this is not only a malware question; it tests whether the organization can detect suspicious administration-like activity, protect recovery paths, preserve evidence, and make fast incident decisions under pressure.

Executive priority

Prioritize this as a resilience and readiness scenario. The official description notes use with living-off-the-land techniques and remote management software, which means normal administrative tooling may be part of the event narrative. Executives should ask whether critical services, backups, network shares, identity-admin activity, and security tools are monitored well enough to support containment, recovery, legal/compliance decisions, and extortion response. Because ATT&CK lists no object-level platforms or detection text, local exposure and control coverage must be validated against the organization’s actual estate.

Technical view

SOC, detection, and IR teams should validate coverage across the related behaviors: command execution through PowerShell and Windows Command Shell; discovery of processes, services, system information, time, files, directories, network shares, security software, and local storage; service creation or modification; service stopping; file deletion; obfuscation/deobfuscation; hidden windows; inter-process communication; selective exclusion; defense impairment; recovery inhibition; and data encryption for impact. Treat the relationship to Medusa Group as context only, not attribution for a local incident. The strongest defensive value is correlating administrative-looking discovery and service activity with backup/recovery tampering, security-tool degradation, abnormal file activity, and encryption impact indicators.

Likely telemetry

  • Endpoint process creation and command-line logging for PowerShell, cmd, service utilities, discovery commands, and scripting activity
  • Windows service creation/modification and service stop events where applicable
  • File-system telemetry for high-volume file modification, deletion, encryption-like activity, and selective exclusion patterns
  • Network share enumeration and access logs, especially around shared drives and sensitive repositories
  • Security tool health, tamper, update, process, and service status telemetry

Detection direction

  • Do not rely on a single malware signature; ATT&CK provides no official detection text for this object and notes living-off-the-land behavior.
  • Build correlations around sequences: discovery activity followed by service stopping, security software discovery or impairment, recovery inhibition, file deletion, and broad file modification/encryption behavior.
  • Tune carefully for administrator false positives, especially service management, PowerShell, command shell, network share enumeration, and remote management activity.
  • Validate that logging survives defense impairment attempts; alerts should include missing, stopped, or degraded security sensors and logging agents.
  • Use the related techniques to structure detection engineering tests, but confirm applicability locally because the malware object itself does not specify platforms.

Mitigation priorities

  • Start with recovery resilience: maintain protected, tested backups and validate that recovery mechanisms cannot be easily disabled or deleted by compromised administrative contexts.
  • Harden and monitor administrative execution paths, including command shells, PowerShell, service control, and remote management software.
  • Restrict and review access to network shares, sensitive file stores, and administrative credentials that can amplify ransomware impact.
  • Protect security tooling from tampering and monitor tool health as a first-class detection signal.
  • Segment critical services and prioritize controls around systems whose encryption or service disruption would affect business continuity or cyber-physical operations.
Additional notes and limits

The relationship set provides useful defensive themes: discovery, execution, stealth, persistence/privilege escalation, defense impairment, recovery inhibition, and encryption impact. The group relationship to Medusa Group should inform threat intelligence enrichment, but incident attribution requires local evidence. The official sources include CISA and multiple vendor reports, but this take uses only the supplied ATT&CK fields and relationship context.

ATT&CK does not provide object-level platforms, tactics, aliases, labels, or official detection guidance for S1244 in the supplied fields. Some related techniques list platforms, but those should not be treated as confirmed Medusa Ransomware platform coverage without local evidence. This summary does not establish current activity, victim exposure, exploit path, or guaranteed detection coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Medusa Ransomware

Medusa Ransomware has been utilized in attacks since at least 2021. Medusa Ransomware has been known to be utilized in conjunction with living off the land techniques and remote management software. Medusa Ransomware has been used in campaigns associated with “double extortion” ransomware activity, where data is exfiltrated from victim environments prior to encryption, with threats to publish files if a ransom is not paid. Medusa Ransomware software was initially a closed ransomware variant which later evolved to a Ransomware as a Service (RaaS). Medusa Ransomware has impacted victims from a diverse range of sectors within a multitude of countries, and it is assessed Medusa Ransomware is used in an opportunistic manner.[1][2][3][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

22 rows
DomainIDNameRelationship / procedure
EnterpriseT1135Network Share Discovery

Medusa Ransomware has identified networked drives.[3][4][2]

EnterpriseT1518.001Security Software DiscoverySub-technique

Medusa Ransomware has the capability to detect security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.[3]

EnterpriseT1027.013Encrypted/Encoded FileSub-technique

Medusa Ransomware has utilized XOR encrypted strings.[3][2]

EnterpriseT1679Selective Exclusion

Medusa Ransomware has avoided specified files, file extensions and folders to ensure successful execution of the payload and continued operations of the impacted device.[3][4][2]

EnterpriseT1007System Service Discovery

Medusa Ransomware has leveraged an encoded list of services that it designates for termination.[3][4][2]

EnterpriseT1490Inhibit System Recovery

Medusa Ransomware has deleted recovery files such as shadow copies using `vssadmin.exe`.[3][1][4][2]

EnterpriseT1543.003Windows ServiceSub-technique

Medusa Ransomware has created a new PowerShell process using the `CreateProcessA` API.[2]

EnterpriseT1057Process Discovery

Medusa Ransomware has utilized an encoded list of the processes that it detects and terminates.[3][4][2]

EnterpriseT1070.004File DeletionSub-technique

Medusa Ransomware has the ability to delete itself after execution.[4] Medusa Ransomware also has the ability to delete itself after execution through the command `cmd /c ping localhost -n 3 > nul & del`.[3][2]

EnterpriseT1680Local Storage Discovery

Medusa Ransomware has enumerated logical drives on infected hosts.[2]

EnterpriseT1489Service Stop

Medusa Ransomware has the capability to terminate services related to backups, security, databases, communication, filesharing and websites.[1][4][2] Medusa Ransomware has also utilized the `taskkill /F /IM /T` command to stop targeted processes and `net stop ` command to stop designated services.[4][2]

EnterpriseT1106Native API

Medusa Ransomware has leveraged Windows Native API functions to execute payloads.[2]

EnterpriseT1140Deobfuscate/Decode Files or Information

Medusa Ransomware has decoded XOR encrypted strings prior to execution in memory.[3][2]

EnterpriseT1564.003Hidden WindowSub-technique

Medusa Ransomware has utilized the `ShowWindow` function to hide current window.[2]

EnterpriseT1559Inter-Process Communication

Medusa Ransomware has leveraged the `CreatePipe` API to enable inter-process communication.[2]

EnterpriseT1083File and Directory Discovery

Medusa Ransomware has searched for files within the victim environment for encryption and exfiltration.[3][1][2] Medusa Ransomware has also identified files associated with remote management services.[3][1]

EnterpriseT1059.003Windows Command ShellSub-technique

Medusa Ransomware has used `cmd.exe` to execute command on an infected host.[3][2]

EnterpriseT1082System Information Discovery

Medusa Ransomware has collected data from the SMBIOS firmware table using `GetSystemFirmwareTable`.[2]

EnterpriseT1059.001PowerShellSub-technique

Medusa Ransomware has launched PowerShell scripts for execution and defense evasion.[3][2]

EnterpriseT1124System Time Discovery

Medusa Ransomware has discovered device uptime through `GetTickCount()`.[2]

EnterpriseT1685Disable or Modify Tools

Medusa Ransomware has terminated antivirus services utilizing the gaze.exe executable.[3] Medusa Ransomware has also terminated antivirus services utilizing PowerShell scripts.[3][2]

EnterpriseT1486Data Encrypted for Impact

Medusa Ransomware has encrypted files using AES-256 encryption, which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”[3][1][4][2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G1051: Medusa Group

Medusa Group has been active since at least 2021 and was initially operated as a closed ransomware group before evolving into a Ransomware-as-a-Service (RaaS) operation. Some reporting indicates that certain attacks may still be conducted directly by the ransomware’s core developers. Public sources have also referred to the group as “Spearwing” or “Medusa Actors.” [1] [2] Medusa Group employs living-off-the-land techniques, frequently leveraging publicly available tools and common remote management software to conduct operations. The group engages in double extortion tactics, exfiltrating data prior to encryption and threatening to publish stolen information if ransom demands are not met. [3] For initial access, Medusa Group has exploited publicly known vulnerabilities, conducted phishing campaigns, and used credentials or access purchased from Initial Access Brokers (IABs). The group is opportunistic and has targeted a wide range of sectors globally. [4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1027.013: Encrypted/Encoded FileEnterpriseuses · TechniqueT1679: Selective ExclusionEnterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1490: Inhibit System RecoveryEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1489: Service StopEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · GroupG1051: Medusa GroupEnterpriseuses · TechniqueT1564.003: Hidden WindowEnterpriseuses · TechniqueT1559: Inter-Process CommunicationEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1685: Disable or Modify ToolsEnterpriseuses · TechniqueT1486: Data Encrypted for ImpactEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
f7d8568f558e821c...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.0Current bundlef7d8568f558e…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  2. [2]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  3. [3]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  4. [4]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  5. [5]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  6. [6]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  7. [7]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  8. [8]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  9. [9]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  10. [10]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  11. [11]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  12. [12]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  13. [13]
    mitre-attackS1244
    Open source URL
  14. [14]
    mitre-attackS1244
    Open source URL
  15. [15]
    mitre-attackS1244
    Open source URL
  16. [16]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  17. [17]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  18. [18]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  19. [19]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  20. [20]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  21. [21]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  22. [22]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  23. [23]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  24. [24]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  25. [25]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  26. [26]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  27. [27]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  28. [28]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  29. [29]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  30. [30]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  31. [31]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  32. [32]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  33. [33]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  34. [34]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  35. [35]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  36. [36]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  37. [37]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  38. [38]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  39. [39]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  40. [40]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  41. [41]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  42. [42]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  43. [43]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  44. [44]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  45. [45]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  46. [46]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  47. [47]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  48. [48]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  49. [49]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  50. [50]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  51. [51]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  52. [52]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  53. [53]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  54. [54]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  55. [55]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  56. [56]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  57. [57]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  58. [58]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  59. [59]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  60. [60]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  61. [61]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  62. [62]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  63. [63]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  64. [64]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  65. [65]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  66. [66]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  67. [67]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  68. [68]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  69. [69]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  70. [70]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  71. [71]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  72. [72]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  73. [73]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  74. [74]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  75. [75]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  76. [76]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  77. [77]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  78. [78]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  79. [79]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  80. [80]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  81. [81]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  82. [82]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  83. [83]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  84. [84]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  85. [85]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  86. [86]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  87. [87]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  88. [88]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  89. [89]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  90. [90]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  91. [91]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  92. [92]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  93. [93]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  94. [94]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  95. [95]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  96. [96]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  97. [97]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  98. [98]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  99. [99]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  100. [100]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  101. [101]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  102. [102]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  103. [103]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  104. [104]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  105. [105]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  106. [106]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  107. [107]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  108. [108]
    Broadcom Medusa Ransomware Medusa Group March 2025

    Threat Hunter Team Symantec and Carbon Black. (2025, March 6). Medusa Ransomware Activity Continues to Increase. Retrieved October 15, 2025.

    Open source URL
  109. [109]
    CISA Medusa Group Medusa Ransomware March 2025

    Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
  110. [110]
    Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024

    Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.

    Open source URL
  111. [111]
    Security Scorecard Medusa Ransomware January 2024

    Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use