Medusa Group

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat disputed (attributed to both Russia and China)

Primary Aliases: G1051 Medusa Actors Medusa Blog MedusaLocker

Sponsor / State Affiliation criminal organization

Primary Motivation financial extortion

Active Timeline Unknown – Present

Confidence Rating 90% (Grounded)

Storm-1175 High-Tempo Operations, GoAnywhere MFT Exploitation, Critical Infrastructure Surge

⚔️ Weaponized CVE Matrix (1)

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Healthcare and Public Health Manufacturing Education Technology Government Legal Insurance Finance

🛡️ MITRE ATT&CK® Attack Lifecycle (8 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Procurement of initial access via Initial Access Brokers (IABs)

Execution 1

T1059 PowerShell obfuscation and security software disabling

Credential Access & Discovery 1

T1003 RDP brute-forcing and credential stuffing

Command & Control 2

T1071 Abuse of Remote Monitoring and Management (RMM) tools (e.g., SimpleHelp, MeshAgent, AnyDesk, TeamViewer)

T1071 Use of Rclone for data exfiltration

Exfiltration & Impact 1

T1485 Double and Triple Extortion (encryption, data leak, and direct contact/DDoS)

Operational Techniques 2

T1000 Exploitation of N-day and Zero-day vulnerabilities in web-facing assets

T1000 Living off the Land (LotL) techniques using legitimate system utilities

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

No recent breaking campaign alerts recorded in the FlagThis threat database.

Copied to clipboard

LINK COPIED TO CLIPBOARD